CVE catalog

CVE-2026-56018

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and n

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibjavascript-minifier-xs-perlsid0.16-1fixed
Debianlibjavascript-minifier-xs-perlforky0.16-1fixed
Debianlibjavascript-minifier-xs-perltrixie0.15-1vulnerable
Debianlibjavascript-minifier-xs-perlbookworm0.15-1vulnerable
Cpelibjavascript-minifier-xs-perlNot reportedNot reportedvulnerable
Alpineperl-javascript-minifier-xs3.240.16-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibjavascript-minifier-xs-perlsourcesid0.16-1not yet assignedNot reportedNot reported
Debianlibjavascript-minifier-xs-perlsourceforky0.16-1not yet assignedNot reportedNot reported
Debianlibjavascript-minifier-xs-perlsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibjavascript-minifier-xs-perlsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Alpineperl-javascript-minifier-xsapk3.240.16-r0Not reportedALPINE-CVE-2026-56018Not reported

Notes

[trixie] libjavascript-minifier-xs-perl: Minor issue [bookworm] libjavascript-minifier-xs-perl: Minor issue; unbounded memory-leak DoS in JS minifier, fixed upstream in 0.16

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjavascript-minifier-xs-perl]Affected

    Source package: [libjavascript-minifier-xs-perl]

    Details (2)

    • 0.15-1+b2 · amd64 · bookworm

      Affected

      nvd · libjavascript-minifier-xs-perl · debian · bookworm; nvd · libjavascript-minifier-xs-perl · debian · 12

    • 0.15-1+b2 · arm64 · bookworm

      Affected

      nvd · libjavascript-minifier-xs-perl · debian · bookworm; nvd · libjavascript-minifier-xs-perl · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]