PT-2026-53733 · Cpan · Javascript::Minifier::Xs

Drclaw1394 + 1 · Published 2026-06-29 · Updated 2026-06-30 · CVE-2026-56018

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JavaScript::Minifier::XS versions prior to 0.16

Description An issue exists where memory is leaked during every call to the minify() function. In the XS.xs component, the cleanup process only frees NodeSet structures and fails to free per-token contents buffers allocated in JsSetNodeContents. Additionally, JsDiscardNode unlinks nodes without freeing their contents. This results in unbounded memory growth for long-lived processes that perform repeated minification, such as server-side minifier endpoints or asset pipelines, potentially leading to a denial of service when available memory is exhausted.

Recommendations Update JavaScript::Minifier::XS to version 0.16 or later.

Fix

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

CVE-2026-56018

Affected Products

Javascript::Minifier::Xs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-56018 · Security Note
• https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10 · Note
• https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes · Note
• http://openwall.com/lists/oss-security/2026/06/29/17 · Note
• https://twitter.com/VulmonFeeds/status/2071820235951190355 · Twitter Post