JavaScript::Minifier::XS vulnerabilities

2 known vulnerabilities in JavaScript::Minifier::XS from GTERMARS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  JavaScript::Minifier::XS: Uncontrolled Resource Consumption

  CVE-2026-56018Jun 29, 2026GTERMARS

  JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeCon

• 7.5 High severity

  JavaScript::Minifier::XS: Out-of-bounds Read

  CVE-2026-56017Jun 29, 2026GTERMARS

  JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte t