Handlebars versions 4.0.0 through 4.7.8 are susceptible to a remote Denial of Service attack that can crash the underlying Node.js process via malformed template input.

The flaw exists in how the library handles unregistered decorator syntax within templates. An unauthenticated attacker can trigger an unhandled TypeError by passing specific decorator strings, leading to the immediate termination of the application process.

This vulnerability poses a significant availability risk to any application that compiles user-supplied templates at request time. A successful exploit results in a Denial of Service, which can disrupt critical business operations and require manual intervention to restart services. With a CVSS score of 7.5, the vulnerability is classified as High severity due to the ease of exploitation and the potential for complete service interruption.

Immediate Action: Update the handlebars package to version 4.7.9 or later immediately.

Proactive Monitoring: Review application error logs and process monitoring dashboards for frequent Node.js process restarts or recurring TypeErrors related to template compilation.

Compensating Controls: If immediate patching is not feasible, implement a try/catch block around all template compilation and rendering logic, or sanitize user input to reject templates containing decorator syntax.

Public Exploit Available: No

Given the high impact on service availability and the simplicity of the attack vector, organizations using Handlebars to process dynamic templates must prioritize this update. Deploying version 4.7.9 is the only definitive way to resolve the underlying logic error. If patching cannot be performed immediately, ensure that input validation or robust error handling is in place to prevent process crashes.