EUVD-2026-16858
GHSA-9cx6-37pm-9jff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit Handlebars template with unregistered decorator syntax
-
ExploitTemplate compiler generates code calling undefined decorator
-
ExecutionRuntime attempts invoking undefined as function
-
ImpactTypeError crashes Node.js process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Handlebars.js application compiles user-supplied templates without try/catch wrapping. Attacker sends template with unregistered decorator syntax (e.g., {{*n}}). Requires network access to template compilation endpoint. No authentication or user interaction needed. Remote unauthenticated DoS against vulnerable Node.js applications using Handlebars. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates network-exploitable, low-complexity attacks requiring no authentication or user interaction, resulting in high availability impact-a textbook DoS scenario. The attack is highly automatable: any HTTP endpoint accepting user-supplied template strings can be crashed with a single malformed request containing decorator syntax. Public proof-of-concept code exists demonstrating three working payloads, lowering the barrier to exploitation. However, real-world risk depends heavily on implementation patterns: applications that pre-compile templates at build time or wrap compile() calls in try/catch blocks are not vulnerable. The vulnerability is not confirmed as actively exploited (not in CISA KEV). Organizations using Handlebars with runtime compilation of untrusted input should prioritize remediation, while those using pre-compilation workflows face minimal risk. The combination of trivial exploitation (AC:L, PR:N) and publicly available POC elevates this above typical theoretical DoS vulnerabilities, particularly for high-availability services using process managers that enable sustained attack loops through automatic restart mechanisms. |
| Exploit ScenarioDerived | An attacker identifies a web application endpoint that accepts user-provided template strings for rendering (e.g., custom email templates, dynamic report generation, or personalized content systems). The attacker submits a minimal payload such as {{*n}} or {{*constructor}} in the template field. When the application calls Handlebars.compile() on the malicious input without error handling, the compiled template throws an unhandled TypeError that crashes the Node.js process. With automated process managers like PM2 or systemd configured for auto-restart, the attacker repeats requests in rapid succession, forcing continuous crash-restart cycles that degrade service availability and consume system resources, achieving persistent denial of service with minimal attacker effort and no authentication required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 27, 2026
Handlebars.js template engine crashes Node.js processes when compiling templates containing unregistered decorator syntax (e.g., {{*n}}), enabling single-request denial-of-service attacks against applications that accept user-supplied templates. The vulnerability affects the npm package handlebars (pkg:npm/handlebars) and has CVSS score 7.5 (AV:N/AC:L/PR:N/UI:N). A functional proof-of-concept demonstrating the crash exists in the public advisory, confirming exploit code is publicly available. No active exploitation (CISA KEV) has been reported at time of analysis.
RemediationAI
Upgrade handlebars to version 4.7.9 or later as documented in the vendor release notes at https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9. The fix is implemented in commit 68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 available at https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2. For environments where immediate upgrading is not feasible, wrap all Handlebars.compile() and template rendering calls in try/catch blocks to prevent process termination, implement input validation to reject templates containing decorator syntax ({{*...}}) before compilation, or migrate to pre-compilation workflows where templates are compiled at build time rather than request time, eliminating runtime compilation of untrusted input entirely. Consult the primary security advisory at https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff for complete remediation guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Handlebars.js is a widely-used JavaScript templating engine for Node.js and browser environments, identified by CPE pkg:npm/handlebars. The vulnerability stems from CWE-754 (Improper Check for Unusual or Exceptional Conditions) in lib/handlebars/compiler/javascript-compiler.js. When the compiler generates code for decorator invocations ({{*decoratorName}}), it produces lookupProperty(decorators, 'decoratorName') and immediately invokes the result as a function without null-checking. Unlike helper references which produce graceful Missing helper errors when unregistered, decorator references return undefined and trigger TypeError: ... is not a function, causing unhandled exceptions that propagate to the Node.js event loop and terminate the process. This asymmetry between helper and decorator error handling creates an exploitable inconsistency in the template compilation runtime.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/handlebars-lang/handlebars.js).
CVSS VectorVendor: https://github.com/handlebars-lang/handlebars.js
Lifecycle Timeline
2DescriptionCVE.org
Summary
When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. {{*n}}), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then immediately invokes the result as a function, causing an unhandled TypeError: ... is not a function that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a try/catch is vulnerable to a single-request Denial of Service.
Description
In lib/handlebars/compiler/javascript-compiler.js, the code generated for a decorator invocation looks like:
fn = lookupProperty(decorators, "n")(fn, props, container, options) || fn;When "n" is not a registered decorator, lookupProperty(decorators, "n") returns undefined. The expression immediately attempts to call undefined as a function, producing:
TypeError: lookupProperty(...) is not a functionBecause the error is thrown inside the compiled template function and is not caught by the runtime, it propagates up as an unhandled exception and - when not caught by the application - crashes the Node.js process.
This inconsistency is notable: references to unregistered helpers produce a clean "Missing helper: ..." error, while references to unregistered decorators cause a hard crash.
Attack scenario: An attacker submits {{*n}} as template content to any endpoint that calls Handlebars.compile(userInput)(). Each request crashes the server process; with process managers that auto-restart (PM2, systemd), repeated submissions create a persistent DoS.
Proof of Concept
const Handlebars = require('handlebars'); // Handlebars 4.7.8, Node.js v22.x
// Any of these payloads crash the process
Handlebars.compile('{{*n}}')({});
Handlebars.compile('{{*decorator}}')({});
Handlebars.compile('{{*constructor}}')({});Expected crash output:
TypeError: lookupProperty(...) is not a function
at Function.eval [as decorator] (eval at compile (...javascript-compiler.js:134:36))Workarounds
- Wrap compilation and rendering in
try/catch:
try {
const result = Handlebars.compile(userInput)(context);
res.send(result);
} catch (err) {
res.status(400).send('Invalid template');
}- Validate template input before passing it to
compile(). Reject templates containing decorator syntax ({{*...}}) if decorators are not used in your application. - Use the pre-compilation workflow: compile templates at build time and serve only pre-compiled templates; do not call
compile()at request time.
Blast Radius
ecosystem impact- 3 npm packages depend on handlebars (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 4.0.0.
Executive ViewAI
Applications using Handlebars.js template engine are vulnerable to single-request denial-of-service attacks when processing user-supplied templates, potentially disrupting service availability for any organization accepting dynamic template input. An unauthenticated attacker can crash Node.js processes by submitting malformed template syntax, making this a direct threat to web applications and services that rely on Handlebars for template compilation.
Apply vendor patch. If immediate patching is not possible, implement input validation to reject template syntax containing unregistered decorator patterns (e.g., {{*n}}); restrict template compilation to pre-defined, server-controlled templates only and disable user-supplied template acceptance where feasible; deploy rate limiting on template compilation endpoints to reduce DOS impact scope.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB