Text::Minify::XS CVE-2026-7040

Exploitation requires that the target application actually route attacker-influenced text into Text::Minify::XS's minify or minify_utf8 functions, and that the input contains specific malformed UTF-8 byte sequences (well-formed UTF-8 does not trigger the flaw). What limits exploitation: the impact is availability-only (a crash/DoS), not code execution per the CVSS vector; the attacker must control the text passed to the minifier, so applications that only minify trusted or static assets are not exposed; and the module must be a vulnerable version (v0.3.0 through pre-v0.7.8). No authentication is required (PR:N) and no special product configuration setting must be enabled beyond simply using the minify functions on untrusted input.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects an availability-only impact: no confidentiality or integrity loss is claimed, only that a crash/DoS can be induced remotely without authentication or user interaction. This is consistent across signals - CISA's SSVC framework rates Exploitation as 'none' with Technical Impact 'partial' and Automatable 'yes', meaning the trigger could be scripted at scale but no impact beyond a crash is expected. EPSS is very low (0.04%, 11th percentile) and the CVE is not in KEV, so this is a real but low-priority, high-CVSS-because-of-A:H issue rather than an urgent RCE. Caveat: heap corruption sometimes carries latent memory-safety risk beyond DoS, but the vector explicitly scores C:N/I:N, so treat any code-execution potential as unconfirmed unless the vendor advisory states otherwise. The AV:N rating is only realistic where the application feeds attacker-controlled/remote text into minify; in batch or local-only pipelines the practical vector is closer to local - verify against your deployment.

An application such as a web templating or asset-minification pipeline passes user-submitted or fetched text through Text::Minify::XS to compress it. An attacker submits a payload containing crafted malformed UTF-8 bytes; the minify function writes past the heap allocation, corrupting memory and crashing the worker process, causing a denial of service. No authentication or user interaction is required per the CVSS vector, and no public POC has been identified at time of analysis.