Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-33939Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
High 7.5
In plain English
A high-severity security flaw in handlebars.js from handlebars-lang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-handlebars | no fix listed | DEBIAN-CVE-2026-33939 |
| Debian:13 | node-handlebars | no fix listed | DEBIAN-CVE-2026-33939 |
| Debian:14 | node-handlebars | 3:4.7.9-1 | DEBIAN-CVE-2026-33939 |
| Ubuntu:22.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-33939 |
| Ubuntu:24.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-33939 |
| Ubuntu:25.10 | node-handlebars | no fix listed | UBUNTU-CVE-2026-33939 |
| Ubuntu:26.04:LTS | node-handlebars | no fix listed | UBUNTU-CVE-2026-33939 |
| Ubuntu:26.10 | node-handlebars | no fix listed | UBUNTU-CVE-2026-33939 |
| npm | handlebars | 4.7.9 | GHSA-9cx6-37pm-9jff |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| handlebars-lang | handlebars.js | >= 4.0.0, < 4.7.9 |
Weakness: CWE-754, CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff x_refsource_CONFIRM
- https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2 x_refsource_MISC
- https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-33939 vdb-entry, x_refsource_REDHAT
- RHBZ#2452508 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10175 vendor-advisory, x_refsource_REDHAT