LiquidJS, the JavaScript template engine compatible with Shopify and GitHub Pages, contains a flaw in its date filter’s strftime implementation. The filter accepts width specifiers such as %9999999d and passes the revealed width to JavaScript’s pad functions without enforcing the engine’s memoryLimit or renderLimit settings. As a result, a simple template such as {{ x | date: '%5000000d' }} can generate megabytes of output and consume unbounded CPU time, potentially exhausting memory, causing out‑of‑memory crashes, or overwhelming a rendering service. The issue is a classic Denial‑of‑Service weakness identified as CWE‑400.

The vulnerability affects all installations of LiquidJS version 10.25.7 and earlier. The library is maintained by Harttle and is distributed through npm. The fix was released in upgrade 10.26.0, which removes the unchecked width handling. Users currently running older releases are exposed to the DoS risk until they upgrade.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests low but non‑zero exploitation probability. Because the flaw can be triggered by any template containing an improperly sized width specifier, there is little technical barrier to exploitation. Attackers can embed such templates in user-generated content or request parameters, leading to large memory allocations, CPU hogging, or out‑of‑memory termination. The vulnerability is not listed in CISA’s KEV catalog, but the impact on hosted services and the ease of exploitation warrant prompt remediation.