{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"10.25.7"}],"component":"liquidjs","cve_ids":["CVE-2026-45357"],"ecosystem":"npm","epss":0.00385,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hh27-hf48-9f5q","id":"tcs_01M5KFV57H0VZG7MTJCBW9PMSM","modified_at":"2026-09-10T03:50:47.056012783Z","published_at":"2026-05-27T17:33:52Z","references":["https://osv.dev/vulnerability/GHSA-hh27-hf48-9f5q","https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q","https://nvd.nist.gov/vuln/detail/CVE-2026-45357","https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed","https://github.com/harttle/liquidjs","https://github.com/harttle/liquidjs/releases/tag/v10.26.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-hh27-hf48-9f5q","url":"https://osv.dev/vulnerability/GHSA-hh27-hf48-9f5q"}],"summary":"LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)"}