Description

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML method on any value that has a truthy toHTML, so such a value throws a TypeError, and because the async substitution runs on a later tick outside the render function's try/catch, the throw is an uncaught exception that terminates the process without sending a response. Only version 4.3.0 is affected, since the throwing escape was introduced by the fix for CVE-2026-16231 and earlier versions do not escape async helper values. It can be triggered remotely when an async helper resolves to an externally influenced object such as parsed JSON. The issue is fixed in hbs 4.3.1, and users should upgrade to hbs 4.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-11T10:16:53.137Z",
  "pubdate": "2026-09-11T10:16:53.137Z",
  "executiveSummary": "The hbs Express view engine wrapper (version 4.3.0) is susceptible to a denial-of-service vulnerability triggered by improperly handled asynchronous helper outputs.\nThe flaw exists within the interaction between async helper resolutions and the escaping mechanism introduced in response to CVE-2026-16231.\nWhen an async helper resolves to a malicious or malformed object containing a truthy but non-callable 'toHTML' property, the internal Handlebars escapeExpression function attempts to invoke this property, resulting in a TypeError.\nBecause the asynchronous substitution occurs outside the standard render function's try/catch block, the exception remains uncaught, leading to immediate Node.js process termination.\nThis vulnerability allows remote attackers to crash the server application by influencing the input processed by these async helpers, such as by submitting crafted JSON payloads.\nThe impact is a complete disruption of service, as the application process exits without responding to the client request. This vulnerability is restricted to version 4.3.0.",
  "technicalDetails": "The root cause of this vulnerability lies in the integration of Handlebars' escapeExpression function within the hbs wrapper, specifically regarding how it processes asynchronous helper results.\nThe issue was inadvertently introduced in version 4.3.0 as a side effect of patching CVE-2026-16231, which mandated stricter escaping for async helper values. In this version, the logic assumes that any object possessing a truthy 'toHTML' property must have that property defined as a callable function.\nWhen an async helper registered via registerAsyncHelper resolves to an object, the library checks for the existence of 'toHTML'. If the property is truthy but not a function, the engine attempts to execute it as if it were a method. This triggers an unhandled TypeError: object is not a function.\nThe vulnerability is critically exposed because the asynchronous substitution occurs on a separate tick of the event loop. By the time this code executes, the context of the initial render function has already been exited, bypassing the established try/catch exception handling mechanisms.\nIn a typical attack scenario, an attacker provides input—such as an external JSON payload—that is subsequently processed by an async helper in the template. If the helper returns the raw JSON object, and that object contains a property named 'toHTML' (e.g., a string or integer), the rendering pipeline collapses.\nThe attack flow proceeds as follows: 1) The attacker transmits a request containing a payload designed to be parsed into an object by the application logic. 2) The application passes this object into a template that utilizes an async helper. 3) The helper resolves, returning the object to the hbs engine. 4) The engine invokes escapeExpression on the result. 5) The engine detects the 'toHTML' property and attempts to invoke it. 6) The resulting TypeError propagates to the process level, as it is outside the scoped catch block. 7) The Node.js process terminates abruptly, rendering the application unavailable to all users.\nThis vulnerability does not require authentication or elevated privileges, as it is triggered through standard request pathways accessible via the network. No further code execution is possible, as the exploit strictly results in process termination."
}