JavaScript::Minifier::XS EUVD-2026-40181

The concrete prerequisite is that the input passed to minify() must have a slash as its first meaningful token - start-of-input, or only whitespace and comments, followed by '/'. Input as small as a single '/' byte triggers the crash. The deployment condition that makes this remotely exploitable is that the vulnerable minify() API must receive attacker-influenced JavaScript (e.g., a service that minifies untrusted or third-party JS from a request). What LIMITS exploitation: the module version must be before 0.16, and the attack surface exists only where untrusted input reaches minify() - a minifier used purely on trusted, developer-authored source at build time is not remotely exploitable and effectively degrades to a local/offline issue. No authentication, privileges, or user interaction are required against a network-exposed minification endpoint (PR:N/UI:N).

The signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) driven entirely by availability - there is no confidentiality or integrity impact, so this is a pure DoS, not RCE despite CWE-476 being a memory-safety class. SSVC reinforces this: Exploitation 'none' (no observed exploitation), Automatable 'yes' (trivial, deterministic trigger), Technical Impact 'partial'. EPSS of 0.49% (38th percentile) is low and aligns with the absence of a KEV listing and no known public exploit code. One caveat on attack vector: AV:N is only accurate when the vulnerable minify() call sits behind a network-facing service that feeds it attacker-controlled JavaScript; for a purely local/offline build-time minifier the practical vector is closer to local. Bottom line: prioritize patching where the module processes untrusted or third-party JS in a request path (exploitation is deterministic and automatable), but this is not a critical RCE and can be scheduled rather than treated as an emergency.

An attacker submits a snippet of JavaScript beginning with a slash - even a single '/' byte - to a web service, build API, or SaaS feature that minifies user-supplied or third-party JavaScript via JavaScript::Minifier::XS. The tokenizer's regexp-versus-division disambiguator walks past the head of the node list, dereferences NULL, and crashes the worker process, denying service. Because the trigger is deterministic and requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), the request can be scripted and repeated; no public POC is currently identified, but the reproduction is trivially described in the disclosure.