CVE-2026-61556

CVE-2026-61556 is an infinite loop in LiquidJS's strip_html filter, triggered by any input containing a `<` character without a closing `>`. The bug is a classic loop index mismanagement: when searching for HTML tags, the code fails to advance the cursor position when the closing bracket search returns -1, causing the loop to stall indefinitely on malformed input. The CVSS 8.7 is earned not through complexity but through ubiquity and blast radius. In Node.js, this is worse than a denial of service against a single request — an infinite loop in a synchronous filter blocks the entire event loop for that process. Every concurrent request, every pending Promise, every health check freezes while the loop spins. The weaponization vector is one character. Any user-controlled value reaching strip_html becomes a kill switch for the template rendering process. This is not a novel mutation. The same infinite-loop pattern in HTML parsing utilities has appeared across Jinja2, Mako, ERB, and older CGI.pm codebases. The fix is mechanically trivial — advance the loop index — but the reason it wasn't done originally is the evidence that matters. Template engine filters are utility code: not the feature that gets demoed, not the auth layer that gets audited. Developers maintaining strip_html are preserving existing functionality with a lower perceived risk profile, which means less rigorous review. The 'template rendering failures are safe' assumption is baked into the development workflow, and that's exactly what allowed a one-character denial-of-service vector to ship. You should verify you're on LiquidJS 10.27.1 or later. Beyond patching, treat template filter code with the same scrutiny you'd apply to parsing logic elsewhere: ensure your integration runs template rendering with timeout isolation, and audit other filters in your template engine for parallel index mismanagement patterns. The vulnerability class — synchronous filter infinite loops blocking the event loop — is not specific to LiquidJS, and your other templating libraries likely have equivalent exposure. Fuzz the filter layer. Assume malformed input will reach it. Assume rendering failures are not contained.

Reviewed through automated stages and approved by a human before publication.