GHSA-9cx6-37pm-9jff — Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Affected: npm: handlebars

## Summary

When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service.

## Description

In `lib/handlebars/compiler/javascript-compiler.js`, the code generated for a decorator invocation looks like:

```javascript fn = lookupProperty(decorators, "n")(fn, props, container, options) || fn; ```

When `"n"` is not a registered decorator, `lookupProperty(decorators, "n")` returns `undefined`. The expression immediately attempts to call `undefined` as a function, producing:

``` TypeError: lookupProperty(...) is not a function ```

Because the error is thrown inside the compiled template function and is not caught by the runtime, it propagates up as an unhandled exception and — when not caught by the application — crashes the Node.js process.

This inconsistency is notable: references to unregistered **helpers** produce a clean `"Missing helper: ..."` error, while references to unregistered **decorators** cause a hard crash.

**Attack scenario:** An attacker submits `{{*n}}` as template content to any endpoint that calls `Handlebars.compile(userIn…

Most recent entries from all

GHSA-9cx6-37pm-9jff — Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation