An uncontrolled recursion vulnerability in the LiquidJS template engine allows unauthenticated attackers to cause a denial of service by exhausting available memory.

This flaw stems from uncontrolled recursion (CWE-674) triggered by a circular block reference in layout and block tags, allowing any user who can submit a template to execute the attack without authentication.

A successful exploitation of this vulnerability results in complete application downtime, as the Node.js process crashes due to a heap out of memory error. This causes service disruption for all users relying on the affected template engine. The CVSS score of 7.5 reflects the high availability impact and ease of remote exploitation.

Immediate Action: Update the liquidjs package to version 10.25.7 or later via npm.

Proactive Monitoring: Monitor server resource utilization, particularly heap memory consumption and Node.js process termination events.

Compensating Controls: Implement input validation or rate limiting on template submissions to prevent untrusted users from supplying deeply nested or circular block references.

Public Exploit Available: No - explicit exploit references or weaponized modules are absent, though a proof-of-concept assessment exists.

Given the severity of potential denial of service attacks, administrators must apply the security update to version 10.25.7 immediately. Upgrading the template engine neutralizes the recursion vector and restores stability to the application environment.