npm/liquidjs CVE-2026-39412: medium 5.3, EPSS 0.40%

LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

Action: Upgrade liquidjs to 10.25.4 or later.

npm i liquidjs@10.25.4

Affected

Fixed versions

Sources

• osv: GHSA-rv5g-f82m-qrvv
• https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-39412
• https://github.com/harttle/liquidjs/pull/869
• https://github.com/harttle/liquidjs/commit/e743da0020d34e2ee547e1cc1a86b58377ebe1ce
• https://github.com/harttle/liquidjs
• https://github.com/harttle/liquidjs/releases/tag/v10.25.4

CVE-2026-39412 · published 2026-04-08T15:04:39Z · modified 2026-09-10T03:51:03.225634128Z · JSON