Log in Start free

Vulnerability · Published Jun 29, 2026 · Assigned by CPANSec

CVE-2026-56018JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth

High 7.5

In plain English

A high-severity memory leak in JavaScript::Minifier::XS from GTERMARS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24perl-javascript-minifier-xs0.16-r0ALPINE-CVE-2026-56018
Debian:12libjavascript-minifier-xs-perlno fix listedDEBIAN-CVE-2026-56018
Debian:13libjavascript-minifier-xs-perlno fix listedDEBIAN-CVE-2026-56018
Debian:14libjavascript-minifier-xs-perl0.16-1DEBIAN-CVE-2026-56018
Ubuntu:22.04:LTSlibjavascript-minifier-xs-perlno fix listedUBUNTU-CVE-2026-56018
Ubuntu:24.04:LTSlibjavascript-minifier-xs-perlno fix listedUBUNTU-CVE-2026-56018
Ubuntu:25.10libjavascript-minifier-xs-perlno fix listedUBUNTU-CVE-2026-56018
Ubuntu:26.04:LTSlibjavascript-minifier-xs-perlno fix listedUBUNTU-CVE-2026-56018
Ubuntu:26.10libjavascript-minifier-xs-perlno fix listedUBUNTU-CVE-2026-56018

Affected products (as reported)

VendorProductVersions
GTERMARS JavaScript::Minifier::XS 0 – before 0.16

Weakness: CWE-401, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References