Vulnerability-Lookup

OPENSUSE-SU-2026:11158-1

Vulnerability from csaf_opensuse - Published: 2026-06-30 00:00 - Updated: 2026-09-17 17:12

Summary

perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media

Description of the patch: These are all security issues fixed in the perl-JavaScript-Minifier-XS-0.160.0-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11158

CVE-2026-56017

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2026-56018

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 4 products, the same list as for CVE-2026-56017

Threats

Impact moderate

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-56017/	self
https://www.suse.com/security/cve/CVE-2026-56018/	self
https://www.suse.com/security/cve/CVE-2026-56017	external
https://bugzilla.suse.com/1269671	external
https://www.suse.com/security/cve/CVE-2026-56018	external
https://bugzilla.suse.com/1269715	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-JavaScript-Minifier-XS-0.160.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11158",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11158-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56017 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56017/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56018 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56018/"
      }
    ],
    "title": "perl-JavaScript-Minifier-XS-0.160.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-09-17T17:12:13Z",
      "generator": {
        "date": "2026-06-30T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11158-1",
      "initial_release_date": "2026-06-30T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-30T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:16:54Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:19:15Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:12:13Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
                "product": {
                  "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
                  "product_id": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-JavaScript-Minifier-XS@0.160.0-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
                "product": {
                  "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
                  "product_id": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-JavaScript-Minifier-XS@0.160.0-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
                "product": {
                  "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
                  "product_id": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-JavaScript-Minifier-XS@0.160.0-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64",
                "product": {
                  "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64",
                  "product_id": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-JavaScript-Minifier-XS@0.160.0-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64"
        },
        "product_reference": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le"
        },
        "product_reference": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x"
        },
        "product_reference": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
        },
        "product_reference": "perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56017",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56017"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash.\n\nThe regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token\u0027s last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer.\n\nThe crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56017",
          "url": "https://www.suse.com/security/cve/CVE-2026-56017"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269671 for CVE-2026-56017",
          "url": "https://bugzilla.suse.com/1269671"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-30T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56017"
    },
    {
      "cve": "CVE-2026-56018",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56018"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.\n\nIn JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token\u0027s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.\n\nA long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56018",
          "url": "https://www.suse.com/security/cve/CVE-2026-56018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269715 for CVE-2026-56018",
          "url": "https://bugzilla.suse.com/1269715"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-JavaScript-Minifier-XS-0:0.160.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-30T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-56018"
    }
  ]
}

CVE-2026-56017 (GCVE-0-2026-56017)

Vulnerability from cvelistv5 – Published: 2026-06-29 19:38 – Updated: 2026-06-29 22:24

Title

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash

Summary

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer. The crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 20:54 UTC

CWE

CWE-476 - NULL Pointer Dereference
CWE-125 - Out-of-bounds Read

Assigner

CPANSec redhat root

References

2 references

URL	Tags
https://metacpan.org/release/GTERMARS/JavaScript-…	release-notes
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
GTERMARS	JavaScript::Minifier::XS	Affected: 0 , < 0.16 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T20:54:26.731930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T20:55:00.530Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:35.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/16"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "JavaScript-Minifier-XS",
          "product": "JavaScript::Minifier::XS",
          "programFiles": [
            "XS.xs"
          ],
          "programRoutines": [
            {
              "name": "JsTokenizeString"
            }
          ],
          "repo": "https://github.com/bleargh45/JavaScript-Minifier-XS",
          "vendor": "GTERMARS",
          "versions": [
            {
              "lessThan": "0.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash.\n\nThe regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token\u0027s last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer.\n\nThe crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T19:38:14.599Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to JavaScript::Minifier::XS version 0.16 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-56017",
    "datePublished": "2026-06-29T19:38:14.599Z",
    "dateReserved": "2026-06-18T11:27:09.117Z",
    "dateUpdated": "2026-06-29T22:24:35.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56018 (GCVE-0-2026-56018)

Vulnerability from cvelistv5 – Published: 2026-06-29 19:38 – Updated: 2026-06-29 22:24

Title

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth

Summary

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 20:52 UTC

CWE

CWE-401 - Missing Release of Memory after Effective Lifetime
CWE-400 - Uncontrolled Resource Consumption

Assigner

CPANSec redhat root

References

3 references

URL	Tags
https://github.com/bleargh45/JavaScript-Minifier-…	issue-tracking
https://metacpan.org/release/GTERMARS/JavaScript-…	release-notes
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
GTERMARS	JavaScript::Minifier::XS	Affected: 0 , < 0.16 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T20:52:50.642184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T20:53:13.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-29T22:24:36.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/29/17"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "JavaScript-Minifier-XS",
          "product": "JavaScript::Minifier::XS",
          "programFiles": [
            "XS.xs"
          ],
          "programRoutines": [
            {
              "name": "JsMinify"
            }
          ],
          "repo": "https://github.com/bleargh45/JavaScript-Minifier-XS",
          "vendor": "GTERMARS",
          "versions": [
            {
              "lessThan": "0.16",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.\n\nIn JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token\u0027s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.\n\nA long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing Release of Memory after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T19:38:35.316Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to JavaScript::Minifier::XS version 0.16 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-56018",
    "datePublished": "2026-06-29T19:38:35.316Z",
    "dateReserved": "2026-06-18T11:27:09.117Z",
    "dateUpdated": "2026-06-29T22:24:36.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11158-1

CVE-2026-56017 (GCVE-0-2026-56017)

CVE-2026-56018 (GCVE-0-2026-56018)

Tags

Sightings

Nomenclature

Related by attack behaviour