What’s Vulnerable › Vulnerabilities

CVE-2026-56018: JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-29 · updated 2026-10-25
• Weakness: CWE-400

Description

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

Affected products

• GTERMARS JavaScript::Minifier::XS: before 0.16 — fixed in 0.16

How to fix

Upgrade to a fixed version: GTERMARS JavaScript::Minifier::XS 0.16. Check the vendor advisory for mitigations.

References

• https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10
• https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes
• http://www.openwall.com/lists/oss-security/2026/06/29/17

Get alerted when CVE-2026-56018 or the next vulnerability affects your stack