LiquidJS versions 10.25.7 and earlier allow the renderLimit option, intended to limit rendering time, to be completely bypassed when a {% for %} or {% tablerow %} tag has an empty body. Because the per‑iteration time check is only reached when the body contains at least one template node, the loop can iterate over an entire collection without consuming any time budget. A crafted template can instantiate a loop over thousands of items, causing the render to seconds to minutes while never triggering the renderLimit. As a result the Node.js event‑loop worker becomes fully occupied, stalling in‑flight requests and causing an application‑wide denial of service. The weakness is a classic resource exhaustion flaw and is identified as CWE‑400.

The affected product is LiquidJS, a vanilla JavaScript template engine for Shopify and GitHub Pages, distributed by the vendor harttle. Versions 10.25.7 and below are affected; the issue was fixed in version 10.26.0. Deployments that rely on a finite renderLimit for DoS protection—common in multi‑tenant template‑authoring environments—must correct these versions to protect availability.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is less than 1%, implying a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Likely attackers are low‑privileged template authors who can submit a crafted template containing an empty loop. The fixed variant remains available in later releases, so updates are the most effective countermeasure.