Executive brief
JavaScript::Minifier::XS is a Perl library used to compress JavaScript code to improve website performance. A flaw in how it processes certain characters allows an attacker to crash the application using the library by providing a specially crafted, very short piece of JavaScript. This results in a denial-of-service (DoS) condition, potentially taking down web services that process user-supplied scripts.
Technical details
A NULL pointer dereference exists in the JsTokenizeString function within XS.xs. The vulnerability is triggered when the first meaningful token in the input is a forward slash (/). The minifier's disambiguation logic attempts to determine if the slash is a regular expression or a division operator by inspecting the previous token; however, if no previous token exists, the pointer walk-back fails, leading to a NULL dereference and subsequent segmentation fault. This is reachable via the public minify() API. The issue is resolved in version 0.16.
Affected products
- GTERMARS JavaScript::Minifier::XS before 0.16
Timeline
- 2026-06-28: patched: Version 0.16 released to fix the issue.
- 2026-06-29: disclosed: CVE-2026-56017 published.