NULL pointer dereference in JavaScript::Minifier::XS for Perl (CVE-2026-56017)

JavaScript::Minifier::XS before version 0.16 for Perl crashes with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp/division disambiguator in JsTokenizeString walks back over preceding tokens to inspect the last byte of the previous token; when no valid preceding token exists, this walk runs off the head of the node list to NULL, causing an out-of-bounds read and subsequent NULL pointer dereference. Because the crash is reachable via the public minify() API with input as small as a single slash byte, a remote attacker can crash any service that minifies untrusted JavaScript, resulting in denial of service. Affected versions: - before 0.16 We recommend updating to: 0.16. CVSS 7.5 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q2/1065 Details: https://vuln.today/cve/CVE-2026-56017