Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., `replace` filter), this causes a V8 Fatal error that crashes the Node.js process, resulting in complete denial of service from a single HTTP request. Version 10.25.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33285 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be compl… https://www.cve.org/CVERecord?id=CVE-2026-33285
Post summary
The CVE‑2026‑33285 vulnerability involves LiquidJS’s memoryLimit enforcement being ineffective in versions before 10.25.1, indicating a potential security flaw that has been formally disclosed.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33285 - LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash Intel Report: https://ift.tt/pOMmj3v
Post summary
The alert announces the new vulnerability CVE-2026-33285 in LiquidJS, outlining a memoryLimit bypass via negative range values that can crash the process, but it provides no exploit, patch, or PoC details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | liquidjs | liquidjs | - | node.js | - |