{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"10.24.0"}],"component":"liquidjs","cve_ids":["CVE-2026-33287"],"ecosystem":"npm","epss":0.00479,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6q5m-63h6-5x4v","id":"tcs_01M5KF7P6N1MM6HM51SGMDEAWA","modified_at":"2026-03-30T14:05:01.240939Z","published_at":"2026-03-25T17:44:23Z","references":["https://osv.dev/vulnerability/GHSA-6q5m-63h6-5x4v","https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v","https://nvd.nist.gov/vuln/detail/CVE-2026-33287","https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d","https://github.com/harttle/liquidjs"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-6q5m-63h6-5x4v","url":"https://osv.dev/vulnerability/GHSA-6q5m-63h6-5x4v"}],"summary":"LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern"}