Is CVE-2026-34166 actively exploited?

No active exploitation of CVE-2026-34166 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34166 be exploited remotely?

Yes. CVE-2026-34166 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34166?

CVE-2026-34166 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34166

MEDIUM

CVE-2026-34166

CWE-400Published: April 8, 2026· Updated: Apr 10, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.1th

Official Description

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.

NVD Source

Technical Analysis

CVE-2026-34166 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.