EUVD-2026-40182
GHSA-fvxv-8c37-qrc6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable when used in a minifier endpoint, no auth or interaction, and the per-call leak yields availability-only impact (C/I:N, A:H); AC:L since any repeated normal call triggers it.
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.
In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.
A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.
AnalysisAI
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Technical ContextAI
JavaScript::Minifier::XS is a Perl distribution (CPAN, author GTERMARS, CPE gtermars:javascript::minifier::xs) that wraps a C/XS minification engine for speed. The defect is in JsMinify within XS.xs: tokenization allocates a per-token contents buffer via JsSetNodeContents, but the teardown only frees the NodeSet node structures, and JsDiscardNode unlinks nodes without releasing their attached contents buffers. This is a classic CWE-401 Missing Release of Memory After Effective Lifetime - the owning pointers to the contents buffers are dropped without free(), so the allocations become unreachable and accumulate. Two early-return branches taken when the node list is empty compound the issue by leaking the whole NodeSet allocation. Because the leak is per-call rather than a fixed one-time cost, total leaked memory scales linearly with request volume.
RemediationAI
Vendor-released patch: upgrade to JavaScript::Minifier::XS 0.16 or later, which adds the missing frees for the per-token contents buffers and the empty-list NodeSet paths (see the 0.16 changelog at https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes and the upstream issue at https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10). If you cannot upgrade immediately, mitigate the unbounded growth operationally: cap process lifetime by recycling minifier workers after a fixed number of requests (e.g., a worker-max-requests setting), enforce a per-process memory limit with a supervisor or cgroup so an OOM kill is contained and the process is auto-restarted rather than dragging down the host, or move minification to a short-lived child process per batch so leaked memory is reclaimed on exit. The trade-off of worker recycling and short-lived processes is added latency/CPU from re-spawning; the trade-off of a hard memory cap is intermittent request failures when the limit is hit. The oss-security advisory is at https://seclists.org/oss-sec/2026/q2/1066.
More in JavaScript
View allDenial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service tha
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploit
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today