EUVD-2026-40182
GHSA-fvxv-8c37-qrc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed minifier endpoint
-
DeliverySubmit repeated minify() requests
-
ExploitLeak per-token contents buffers each call
-
ExecutionResident memory grows unbounded
-
ImpactProcess OOM-killed, service denied
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that the target run JavaScript::Minifier::XS below 0.16 inside a long-lived process that calls minify() repeatedly - explicitly a server-side minifier endpoint or a persistent asset-pipeline worker, per the CVE description. The leak occurs on every minify() call (including the empty-node-list early-return paths), so no special feature flag or non-default configuration is needed; the limiting factor is reachability and process longevity, not authentication. What limits real-world impact: the process must be long-running and must accept enough attacker-influenced minify calls to accumulate memory before any natural restart - a one-shot CLI or build step that exits after each run reclaims the leaked memory and is not practically exploitable. The CVSS PR:N/UI:N holds only where minification input is reachable without authentication; behind auth or used only at build time, exposure is correspondingly reduced. |
| Impact | Signals are consistent but point to a resource-exhaustion DoS rather than a code-execution emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) yields 7.5 with availability-only impact, matching the leak's effect. SSVC reinforces this: Exploitation=none (no observed in-the-wild activity), Automatable=yes (the trigger is a simple repeated minify call, easily scripted), Technical Impact=partial. There is no EPSS value supplied and the CVE is not in CISA KEV, so this is not confirmed actively exploited; no public exploit was identified. The AV:N rating is contextual - it only applies when minify() is reachable from network input (e.g., a minifier endpoint or asset pipeline fed untrusted JS); a build-time-only use of the module is effectively local and lower risk. Net: a real but bounded priority - patch promptly on internet-facing or long-running services, lower urgency for one-shot CLI/build usage. |
| Exploit ScenarioDerived | An attacker identifies a service that minifies user- or build-supplied JavaScript on the fly - for example a server-side minifier API or a persistent asset-pipeline worker - and submits a continuous stream of minify requests. Each call leaks the token contents buffers, so the worker's resident memory climbs steadily until the OS OOM-killer terminates it, denying service to legitimate users. No public exploit is required; the trigger is simply repeated normal use, and SSVC rates it automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
RemediationAI
Vendor-released patch: upgrade to JavaScript::Minifier::XS 0.16 or later, which adds the missing frees for the per-token contents buffers and the empty-list NodeSet paths (see the 0.16 changelog at https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes and the upstream issue at https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10). If you cannot upgrade immediately, mitigate the unbounded growth operationally: cap process lifetime by recycling minifier workers after a fixed number of requests (e.g., a worker-max-requests setting), enforce a per-process memory limit with a supervisor or cgroup so an OOM kill is contained and the process is auto-restarted rather than dragging down the host, or move minification to a short-lived child process per batch so leaked memory is reclaimed on exit. The trade-off of worker recycling and short-lived processes is added latency/CPU from re-spawning; the trade-off of a hard memory cap is intermittent request failures when the limit is hit. The oss-security advisory is at https://seclists.org/oss-sec/2026/q2/1066.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JavaScript::Minifier::XS is a Perl distribution (CPAN, author GTERMARS, CPE gtermars:javascript::minifier::xs) that wraps a C/XS minification engine for speed. The defect is in JsMinify within XS.xs: tokenization allocates a per-token contents buffer via JsSetNodeContents, but the teardown only frees the NodeSet node structures, and JsDiscardNode unlinks nodes without releasing their attached contents buffers. This is a classic CWE-401 Missing Release of Memory After Effective Lifetime - the owning pointers to the contents buffers are dropped without free(), so the allocations become unreachable and accumulate. Two early-return branches taken when the node list is empty compound the issue by leaking the whole NodeSet allocation. Because the leak is per-call rather than a fixed one-time cost, total leaked memory scales linearly with request volume.
Know when JavaScript gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable when used in a minifier endpoint, no auth or interaction, and the per-call leak yields availability-only impact (C/I:N, A:H); AC:L since any repeated normal call triggers it.
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.
In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.
A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.
Executive ViewAI
JavaScript::Minifier::XS before version 0.16 contains a remotely exploitable memory leak vulnerability affecting any web service or build system that minifies JavaScript code. Although no public exploit has been identified, the vulnerability is trivially exploitable and poses an availability risk through denial of service to dependent systems.
Apply vendor patch. If immediate patching is not feasible, implement request rate limiting on minification endpoints, enable per-process memory consumption monitoring with alerting thresholds, and restrict minification API access to authenticated or internal users only until patch deployment is complete.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in JavaScript
View allCommand injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allo
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command
Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and termin
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB