[GHSA-6q5m-63h6-5x4v] LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

[SiteQ8]

Updates

• Affected products

Comments
The fix shipped in liquidjs 10.25.1 (published to npm on 2026-03-22), so this advisory should list 10.25.1 as the patched version and cover every earlier release. The fix commit this advisory already cites, 35d5230 (fix: treat args for replace_first as literal), is first contained in tag v10.25.1 and is listed under 10.25.1 in the project changelog. The current range stops at 10.24.0, which leaves out 10.25.0: it was published on 2026-03-07, before the fix, and does not contain the commit.

Evidence:
harttle/liquidjs@35d5230
https://github.com/harttle/liquidjs/blob/v10.25.1/CHANGELOG.md
https://github.com/harttle/liquidjs/releases/tag/v10.25.1
https://www.npmjs.com/package/liquidjs?activeTab=versions

[github]

Hi there @harttle! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory