CVE-2026-33939: handlebars-lang handlebars.js

Vulnerability summary

CVE-2026-33939 is a high (CVSS 7.5) vulnerability in handlebars-lang handlebars.js. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-03-2026
   PublishedVulnerability first disclosed.
2. 04-09-2026
   Last modifiedVulnerability information updated.

Description

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
• CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.