CVE-2026-56017: Perl JavaScript::Minifier::XS DoS Vulnerability

CVE-2026-56017 Overview

CVE-2026-56017 is a NULL pointer dereference vulnerability in the JavaScript::Minifier::XS Perl module in versions before 0.16. The flaw resides in the JsTokenizeString function in XS.xs, where the regexp-versus-division disambiguator inspects the previous token's last byte. When a slash character appears as the first meaningful token in input, the walk back over whitespace and comment nodes runs off the head of the node list to NULL. The byte lookup then reads through a NULL contents pointer, crashing the process.

The vulnerability is triggered through the public minify() API and requires no authentication.

Critical Impact
A single slash byte submitted to a service that minifies untrusted JavaScript crashes the calling process, enabling remote denial of service.

Affected Products

JavaScript::Minifier::XS for Perl, versions prior to 0.16
Web services and build pipelines that minify untrusted or third-party JavaScript via the module
Applications embedding the module's minify() API in request-handling code paths

Discovery Timeline

2026-06-29 - CVE-2026-56017 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-56017

Vulnerability Analysis

The vulnerability is a NULL pointer dereference classified under [CWE-125] (Out-of-Bounds Read). The JsTokenizeString function in XS.xs implements a disambiguator that determines whether a / character represents a regular expression literal or a division operator. This decision depends on inspecting the last byte of the preceding meaningful token.

When a slash is the first meaningful token in the input, no valid preceding token exists. The tokenizer walks backward past whitespace and comment nodes and runs off the head of the linked list, arriving at NULL. The code then reads a byte through the NULL contents pointer at an underflowed length index. A subsequent identifier check dereferences the same NULL pointer, crashing the calling process.

Because the crash is reachable through the public minify() API, any Perl application that passes attacker-controlled JavaScript into the minifier is affected. Build servers, content delivery pipelines, and web services that dynamically minify third-party scripts are exposed.

Root Cause

The root cause is missing input validation for the boundary condition where the input begins with a slash. The disambiguator assumes at least one preceding token exists and dereferences the resulting node without a NULL check. The underflowed index calculation compounds the issue by reading before the start of the buffer.

Attack Vector

An unauthenticated remote attacker submits JavaScript input beginning with a / character to any endpoint that invokes JavaScript::Minifier::XS::minify(). Input as small as a single byte reliably crashes the worker process. Repeated requests sustain a denial of service against the affected service.

The vulnerability manifests in the tokenizer's node-list traversal logic. Refer to the MetaCPAN Release Notes and the OpenWall OSS-Security Discussion for the maintainer's technical description of the fix.

Detection Methods for CVE-2026-56017

Indicators of Compromise

Unexpected termination or segmentation faults in Perl worker processes that invoke JavaScript::Minifier::XS
Web server error logs showing SIGSEGV or NULL pointer crashes in FastCGI, mod_perl, or PSGI workers
HTTP requests containing JavaScript payloads that begin with a / character followed by minimal content
Repeated 5xx errors correlated with minification endpoints

Detection Strategies

Inventory Perl applications and CPAN dependencies to identify installations of JavaScript::Minifier::XS below version 0.16
Inspect application logs for crash signatures originating from XS.xs or the JsTokenizeString function
Deploy web application firewall rules to flag POST bodies or upload payloads consisting of a lone / or leading slash tokens submitted to minification endpoints

Monitoring Recommendations

Alert on abnormal restart rates for Perl worker pools and PSGI application servers
Track HTTP 502 and 503 error rates on endpoints that accept user-supplied JavaScript
Monitor process exit codes and core dump generation on hosts running the vulnerable module

How to Mitigate CVE-2026-56017

Immediate Actions Required

Upgrade JavaScript::Minifier::XS to version 0.16 or later using cpanm or the distribution package manager
Audit all services that pass externally sourced JavaScript into minify() and restrict access where possible
Restart affected Perl worker processes after upgrading to ensure the patched shared object is loaded

Patch Information

The maintainer released JavaScript::Minifier::XS version 0.16 on CPAN, which adds NULL checks to the regexp-versus-division disambiguator in JsTokenizeString. Refer to the MetaCPAN Release Notes for the full change list and to the OpenWall OSS-Security Discussion for the coordinated disclosure thread.

Workarounds

Reject or sanitize input where the first non-whitespace, non-comment byte is / before passing content to minify()
Isolate minification into a separate process with automatic restart and rate limiting to contain crash impact
Precompute minified assets from trusted source only, and disable on-demand minification of third-party JavaScript until the patch is applied

bash

# Upgrade the vulnerable module from CPAN
cpanm JavaScript::Minifier::XS@0.16

# Verify the installed version
perl -MJavaScript::Minifier::XS -E 'say $JavaScript::Minifier::XS::VERSION'