https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:10:14 +0000 https://vulnerability.circl.lu/vuln/ghsa-4rc3-7j7w-m548 <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Summary</p> <p>A circular block reference in `{% layout %}` / `{% block %}` causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with `FATAL ERROR: JavaScript heap out of memory`. This allows any user who can submit a Liquid template to perform a Denial of Service attack.</p> <p>### Details</p> <p>In `src/tags/block.ts`, during OUTPUT mode, each block looks up its render function from `ctx.getRegister(&#39;blocks&#39;)[this.block]`. When a block with name `a` is nested inside another block also named `a` in a child template, the inner block finds the outer block&#39;s render function and calls it. The outer block&#39;s templates contain the inner block again, creating infinite recursion with no termination condition.</p> <p>Relevant code (`src/tags/block.ts`, `getBlockRender` method):</p> <p>```typescript private getBlockRender (ctx: Context) { const { liquid, templates } = this const renderChild = ctx.getRegister(&#39;blocks&#39;)[this.block] const renderCurrent = function * (superBlock: BlockDrop, emitter: Emitter) { ctx.push({ block: superBlock }) yield liquid.renderer.renderTemplates(templates, ctx, emitter) ctx.pop() } return renderChild ? (superBlock: BlockDrop, emitter: Emitter) =&gt; renderChild( new BlockDrop( (emitter: Emitter) =&gt; renderCurrent(superBlock, emitter) ), emitter) : renderCurrent } ```</p> <p>When `renderChild` exists (same-name block found), it calls `renderChild` which re-renders templates con…</p> <p><strong>Affected:</strong> npm: liquidjs</p> <p>### Summary</p> <p>A circular block reference in `{% layout %}` / `{% block %}` causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with `FATAL ERROR: JavaScript heap out of memory`. This allows any user who can submit a Liquid template to perform a Denial of Service attack.</p> <p>### Details</p> <p>In `src/tags/block.ts`, during OUTPUT mode, each block looks up its render function from `ctx.getRegister(&#39;blocks&#39;)[this.block]`. When a block with name `a` is nested inside another block also named `a` in a child template, the inner block finds the outer block&#39;s render function and calls it. The outer block&#39;s templates contain the inner block again, creating infinite recursion with no termination condition.</p> <p>Relevant code (`src/tags/block.ts`, `getBlockRender` method):</p> <p>```typescript private getBlockRender (ctx: Context) { const { liquid, templates } = this const renderChild = ctx.getRegister(&#39;blocks&#39;)[this.block] const renderCurrent = function * (superBlock: BlockDrop, emitter: Emitter) { ctx.push({ block: superBlock }) yield liquid.renderer.renderTemplates(templates, ctx, emitter) ctx.pop() } return renderChild ? (superBlock: BlockDrop, emitter: Emitter) =&gt; renderChild( new BlockDrop( (emitter: Emitter) =&gt; renderCurrent(superBlock, emitter) ), emitter) : renderCurrent } ```</p> <p>When `renderChild` exists (same-name block found), it calls `renderChild` which re-renders templates con…</p> https://vulnerability.circl.lu/vuln/ghsa-4rc3-7j7w-m548