LiquidJS is a template engine that enforces a memory limit through a "memoryLimit" setting to prevent excessive resource usage. Prior to version 10.25.1 this limit can be fully bypassed by using reverse range expressions such as (100000000..1). When combined with a string‑flattening operation, the V8 engine throws a fatal error that crashes the Node.js process. The result is a complete denial of service caused by a single HTTP request.

The vulnerability affects versions of LiquidJS supplied by harttle:liquidjs that are older than 10.25.1. All releases before that version are susceptible when the memoryLimit feature is enabled.

The CVSS score of 7.5 indicates a high severity. EPSS is below one percent, implying low current exploitation activity; it is not listed in the CISA KEV catalog. The likely attack vector is remote, via a crafted HTTP request to an application that uses the vulnerable LiquidJS engine. An attacker can trigger the crash from the outside without local privileges, leading to service interruption.