CVE-2026-33939— Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

对因果或异常条件的不恰当检查

handlebars 代码问题漏洞

handlebars是一款语义化的Web模板系统。 Handlebars 4.7.8及之前版本存在代码问题漏洞，该漏洞源于模板包含未注册装饰器引用时导致未处理的TypeError，可能导致Node.js进程崩溃，引发单请求拒绝服务攻击。

N/A

N/A