---
id: CVE-2026-87123
title: hbs is an Express view engine wrapper for Handlebars
summary: >-
  hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash
  the Node.js process during output escaping when an async helper, registered
  with registerAsyncHelper, resolves to an object whose toHTML property is
  truthy but…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
vendor: hbs
product: hbs
affected:
  - hbs >= 4.3.0 < 4.3.1
published: '2026-09-11'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:40:00.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-87123'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/pillarjs/hbs/security/advisories/GHSA-3c55-w9jx-p5jr'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
  - cve.org
epss: 0.00412
epssPercentile: 0.32687
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T10:28:38.308689Z'
ingestedAt: '2026-09-11T16:45:47.924Z'
---

## Overview

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML method on any value that has a truthy toHTML, so such a value throws a TypeError, and because the async substitution runs on a later tick outside the render function's try/catch, the throw is an uncaught exception that terminates the process without sending a response. Only version 4.3.0 is affected, since the throwing escape was introduced by the fix for CVE-2026-16231 and earlier versions do not escape async helper values. It can be triggered remotely when an async helper resolves to an externally influenced object such as parsed JSON. The issue is fixed in hbs 4.3.1, and users should upgrade to hbs 4.3.1 or later.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.