CVE-2026-33285 impacts LiquidJS versions prior to 10.25.1, allowing attackers to bypass the `memoryLimit` security mechanism. This vulnerability enables unlimited memory allocation, which, when combined with specific operations, triggers a V8 Fatal error and results in complete Denial of Service (DoS) for Node.js processes from a single HTTP request. Rated 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it presents a low-complexity network attack vector requiring no privileges or user interaction. There is currently no evidence of active exploitation, nor are public exploit modules available, though it has received some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.25.1CPE matchmatch criteria | cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.