The vulnerability is caused by an unhandled TypeError that occurs during output escaping when an async helper resolves to an object with a truthy but non‑callable toHTML property. Handlebars escapeExpression attempts to call toHTML, causing the exception to escape the render function’s try/catch and terminate the Node.js process. This results in a denial of service, disrupting service availability for legitimate users. The weakness is identified as CWE-248, a type of Value Uninitialized Exception.

The product in question is hbs, the Express view engine wrapper for Handlebars, provided by the OpenJSF community. Only version 4.3.0 is affected; the issue is resolved in 4.3.1 and later releases. Applications using hbs 4.3.0 as the view engine should consider the environment vulnerable.

The CVSS score is 5.9, indicating a medium severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly documented exploitation yet. However, the attack can be triggered remotely if an attacker can influence the resolution of an async helper, for example by providing parsed JSON that includes a non‑callable toHTML property. Because the exception propagates terminates the entire Node.js process, making the attack straightforward for an adversary that can inject such data.