CVE-2026-87123: hbs Express View Engine DOS Vulnerability

CVE-2026-87123 Overview

CVE-2026-87123 is a denial-of-service vulnerability in hbs, an Express view engine wrapper for Handlebars. Version 4.3.0 crashes the Node.js process during output escaping when an async helper registered with registerAsyncHelper resolves to an object whose toHTML property is truthy but not callable. The uncaught TypeError terminates the process without sending a response. The issue is remotely triggerable when an async helper resolves to an externally influenced object such as parsed JSON. Only version 4.3.0 is affected, and the fix is available in hbs 4.3.1.

Critical Impact
A remote attacker can crash the entire Node.js process by supplying JSON input that reaches an async helper, resulting in service outage without any response returned to clients.

Affected Products

hbs version 4.3.0 (Express view engine wrapper for Handlebars)
Node.js applications using registerAsyncHelper with externally influenced object inputs
Versions prior to 4.3.0 are not affected because they do not escape async helper values

Discovery Timeline

2026-09-11 - CVE-2026-87123 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87123

Vulnerability Analysis

The vulnerability sits at the intersection of Handlebars output escaping and asynchronous helper resolution in hbs 4.3.0. Handlebars escapeExpression invokes the toHTML method on any value whose toHTML property is truthy. When an async helper resolves to an object where toHTML exists but is not a function, calling it throws a TypeError. Because the async substitution runs on a later tick, the throw occurs outside the render function's try/catch boundary. The result is an uncaught exception [CWE-248] that terminates the Node.js process before any HTTP response is sent. Recovery requires the process manager to restart the worker, and repeated triggers cause sustained denial of service.

Root Cause

The throwing escape path was introduced by the fix for CVE-2026-16231, which added escaping for async helper values in 4.3.0. Earlier versions did not escape async helper output, so they never reached the toHTML call site. The root cause is unhandled exception propagation from a deferred microtask, combined with permissive coercion of arbitrary object shapes into HTML.

Attack Vector

An attacker submits input that eventually flows into an async helper as an object whose toHTML property is any truthy non-function value. Common vectors include HTTP request bodies parsed as JSON and passed to a helper for rendering. When the template renders, the escape routine calls toHTML(), raises a TypeError, and crashes the process on the next tick. The attack requires no authentication and no user interaction, but exploitation depends on an application registering an async helper that returns externally controlled objects.

No verified proof-of-concept code is available. See the GitHub Security Advisory GHSA-3c55-w9jx-p5jr for technical details.

Detection Methods for CVE-2026-87123

Indicators of Compromise

Unexpected Node.js process restarts logged by the process manager (pm2, systemd, Kubernetes) coinciding with template rendering requests
Uncaught TypeError entries in stderr referencing escapeExpression or toHTML is not a function
HTTP requests that return no response body and terminate mid-render, often followed by a 502 or 504 from an upstream proxy

Detection Strategies

Inventory installed hbs package versions across Node.js services and flag any instance pinned to 4.3.0
Static analysis of application code for calls to hbs.registerAsyncHelper that return objects derived from request input
Runtime monitoring for process.on('uncaughtException') events that correlate with template rendering call stacks

Monitoring Recommendations

Enable structured logging of unhandled exceptions and alert on crash-loop patterns in web-tier workers
Track worker restart counts and mean time between crashes as a health metric for Node.js services
Correlate application crashes with HTTP request bodies containing unusual JSON structures targeting rendered endpoints

How to Mitigate CVE-2026-87123

Immediate Actions Required

Upgrade hbs to version 4.3.1 or later across all Node.js applications
Audit application code for registerAsyncHelper usage that returns request-derived objects and add input validation
Confirm that Express error handlers and process managers are configured to log and restart on uncaught exceptions

Patch Information

The issue is fixed in hbs 4.3.1. Users should upgrade with npm install hbs@^4.3.1 or the equivalent for their package manager. Refer to the OpenJS Foundation Security Advisories and GitHub Security Advisory GHSA-3c55-w9jx-p5jr for release details.

Workarounds

Downgrade to a pre-4.3.0 release only if the CVE-2026-16231 escape fix is not required for the deployment
Sanitize async helper return values by returning primitive strings or objects with a callable toHTML function
Wrap async helper logic to strip or validate any toHTML property present on externally sourced objects before returning

bash

# Upgrade hbs to the patched release
npm install hbs@^4.3.1
npm ls hbs