{"cvss":7.5,"datePublished":"2026-03-27T22:16:20.857","dateUpdated":"2026-10-26T22:10:00.163","description":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time.","id":"CVE-2026-33939","raw":{"affected":[{"affectedData":[{"product":"handlebars.js","vendor":"handlebars-lang","versions":[{"status":"affected","version":">= 4.0.0, < 4.7.9"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf4-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839279","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/logging-console-plugin-pf5-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782840539","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cluster_observability_operator:1.5::el9"],"defaultStatus":"affected","packageName":"cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9","product":"Cluster Observability Operator 1.5.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782839996","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_devspaces:3.27::el9"],"defaultStatus":"affected","packageName":"devspaces/code-rhel9","product":"Red Hat OpenShift Dev Spaces 3.27","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1776744110","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:cryostat:4"],"defaultStatus":"unaffected","packageName":"handlebars","product":"Cryostat 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch6-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-operator-bundle","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-proxy-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/elasticsearch-rhel9-operator","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/kibana6-rhel8","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"affected","packageName":"openshift-logging/logging-curator5-rhel9","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"handlebars","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"firefox","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"thunderbird","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"firefox","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"389-ds:1.4/389-ds-base","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"firefox","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"grafana","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mozjs60","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"thunderbird","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"firefox","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"thunderbird","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"defaultStatus":"unaffected","packageName":"handlebars","product":"Red Hat Process Automation 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:handlebarsjs:handlebars:*:*:*:*:*:node.js:*:*","matchCriteriaId":"A9D1F9A7-8359-4C3F-9932-4A085094F388","versionEndExcluding":"4.7.9","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, \"n\")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing  decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled  templates; do not call `compile()` at request time."},{"lang":"es","value":"Handlebars proporciona la potencia necesaria para permitir a los usuarios construir plantillas semánticas. En las versiones 4.0.0 a 4.7.8, cuando una plantilla de Handlebars contiene sintaxis de decorador que hace referencia a un decorador no registrado (por ejemplo, ’{{n}}’), la plantilla compilada llama a ’lookupProperty(decorators, ’n’)’, lo que devuelve ’undefined’. El tiempo de ejecución invoca inmediatamente el resultado como una función, causando un “TypeError” no manejado: ’... no es una función’ que bloquea el proceso de Node.js. Cualquier aplicación que compile plantillas proporcionadas por el usuario sin envolver la llamada en un “try/catch” es vulnerable a una denegación de servicio de una sola solicitud. La versión 4.7.9 corrige el problema. Algunas soluciones alternativas están disponibles. Envuelva la compilación y la renderización en “try/catch”. Valide la entrada de la plantilla antes de pasarla a “compile()”; rechace las plantillas que contengan sintaxis de decorador (’{{*...}}’) si los decoradores no se utilizan en su aplicación. Utilice el flujo de trabajo de precompilación; compile las plantillas en tiempo de compilación y sirva solo plantillas precompiladas; no llame a “compile()” en tiempo de solicitud."}],"id":"CVE-2026-33939","lastModified":"2026-10-26T22:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33939","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-30T18:52:18.558792Z","version":"2.0.3"}}]},"published":"2026-03-27T22:16:20.857","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-33939"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452508"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-248"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"Handlebars provides the power necessary to let users build semantic templates"}