JavaScript
Monthly
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.