EUVD-2026-40181
GHSA-72fp-jmq3-p5xj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Deterministic single-byte trigger with no auth or interaction gives AC:L/PR:N/UI:N; impact is a pure process crash so C:N/I:N/A:H, and AV:N holds only where a remote service feeds untrusted JS to minify().
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash.
The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer.
The crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service.
AnalysisAI
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Technical ContextAI
The affected component is JavaScript::Minifier::XS, a Perl module (namespace gtermars per the CPE cpe:2.3:a:gtermars:javascript::minifier::xs) that wraps a C tokenizer/minifier via Perl's XS (native extension) layer for speed. The root cause lives in JsTokenizeString within XS.xs: the tokenizer must disambiguate a '/' as either the start of a regular-expression literal or a division operator, and it does so by inspecting the last byte of the previous token. It walks backward over whitespace and comment nodes to find that token. When '/' is the first meaningful token - preceded only by start-of-input, whitespace, or comments - the backward walk runs off the head of the linked node list to NULL, and the code then reads through a NULL contents pointer at an underflowed length index; a subsequent identifier check dereferences the same NULL pointer. CWE-476 (NULL Pointer Dereference) precisely captures this: a missing guard for the 'no preceding token' boundary condition causes an invalid memory read/dereference and a hard process crash.
RemediationAI
Upgrade to JavaScript::Minifier::XS 0.16 or later, the vendor-released patched version available on CPAN (https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes); this is the primary and complete fix. Until the upgrade is deployed, if the module processes untrusted input, wrap the minify() call in a crash-isolated worker or child process so a single request cannot take down the parent service, and/or add an input-validation guard in the calling code that rejects input whose first non-whitespace, non-comment character is a slash - note that naive filtering of leading slashes may reject legitimate scripts that begin with a regex literal, so prefer process isolation over content filtering. Restrict the minification endpoint to authenticated or trusted callers where feasible to reduce exposure. Advisory and disclosure details: oss-security https://seclists.org/oss-sec/2026/q2/1065, NVD https://nvd.nist.gov/vuln/detail/CVE-2026-56017, and VulDB https://vuldb.com/vuln/374740.
More in JavaScript
View allUncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers ex
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploit
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today