Executive brief
JavaScript::Minifier::XS is a Perl library used to compress JavaScript files to improve website performance. A flaw in the library causes it to leak memory every time it processes a file. Over time, a server using this library will consume all available system memory, leading to a crash or service outage.
Technical details
A memory leak exists in the JsMinify function within XS.xs due to improper resource management. The cleanup routine frees NodeSet structures but fails to release per-token contents buffers allocated in JsSetNodeContents. Additionally, JsDiscardNode unlinks nodes without freeing their associated buffers, and early returns in the node list processing leak the entire NodeSet. An attacker can trigger this by repeatedly submitting JavaScript to a server-side minification endpoint, leading to process termination via memory exhaustion (OOM). The issue is resolved in version 0.16.
Affected products
- GTERMARS JavaScript::Minifier::XS before 0.16
Timeline
- 2026-05-14: disclosed: Issue reported on GitHub repository
- 2026-06-28: patched: Version 0.16 released to CPAN
- 2026-06-29: advisory: CVE published to NVD