<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
  <id>https://vulnerability.circl.lu/rss/recent/all/10</id>
  <title>Most recent entries from all</title>
  <updated>2026-10-02T17:10:13.266639+00:00</updated>
  <author>
    <name>Vulnerability-Lookup</name>
    <email>info@circl.lu</email>
  </author>
  <link href="https://vulnerability.circl.lu" rel="alternate"/>
  <generator uri="https://lkiesow.github.io/python-feedgen" version="1.0.0">python-feedgen</generator>
  <subtitle>Contains only the most 10 recent entries.</subtitle>
  <entry>
    <id>https://vulnerability.circl.lu/vuln/ghsa-4rc3-7j7w-m548</id>
    <title>GHSA-4rc3-7j7w-m548 — liquidjs has a Denial of Service via circular block reference in layout</title>
    <updated>2026-10-02T17:10:16.141194+00:00</updated>
    <content type="xhtml">
      <div xmlns="http://www.w3.org/1999/xhtml"><p><strong>Affected:</strong> npm: liquidjs</p>
<p>### Summary</p>
<p>A circular block reference in `{% layout %}` / `{% block %}` causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with `FATAL ERROR: JavaScript heap out of memory`. This allows any user who can submit a Liquid template to perform a Denial of Service attack.</p>
<p>### Details</p>
<p>In `src/tags/block.ts`, during OUTPUT mode, each block looks up its render function from `ctx.getRegister('blocks')[this.block]`. When a block with name `a` is nested inside another block also named `a` in a child template, the inner block finds the outer block's render function and calls it. The outer block's templates contain the inner block again, creating infinite recursion with no termination condition.</p>
<p>Relevant code (`src/tags/block.ts`, `getBlockRender` method):</p>
<p>```typescript
private getBlockRender (ctx: Context) {
  const { liquid, templates } = this
  const renderChild = ctx.getRegister('blocks')[this.block]
  const renderCurrent = function * (superBlock: BlockDrop, emitter: Emitter) {
    ctx.push({ block: superBlock })
    yield liquid.renderer.renderTemplates(templates, ctx, emitter)
    ctx.pop()
  }
  return renderChild
    ? (superBlock: BlockDrop, emitter: Emitter) =&gt; renderChild(
        new BlockDrop(
          (emitter: Emitter) =&gt; renderCurrent(superBlock, emitter)
        ),
        emitter)
    : renderCurrent
}
```</p>
<p>When `renderChild` exists (same-name block found), it calls `renderChild` which re-renders templates con…</p></div>
    </content>
    <link href="https://vulnerability.circl.lu/vuln/ghsa-4rc3-7j7w-m548"/>
  </entry>
</feed>
