The vulnerability resides in the LiquidJS template engine. A circular block reference using the {% layout %} and {% block %} tags leads to an infinite recursion that exhausts the JavaScript heap, resulting in a crash of the Node.js process. The impact is a denial of service to any running instance that renders untrusted templates.

Affected products are those that use the LiquidJS library before version 10.25.7. The vendor is Harttle, and the library is the pure JavaScript LiquidJS engine. All deployments that embed LiquidJS in a Node.js environment and accept user‑submitted templates are vulnerable. The fix is available in release 10.25.7.

The CVSS score of 7.5 indicates a high severity. Exploitation requires the ability to submit a template, which is common in web applications that allow content authoring or show custom macros. No exploitation data in EPSS or KEV, but the attack path is straightforward and can be performed remotely from a compromised crawler or attacker with template upload privileges. Immediate patching is strongly recommended.