CVE-2026-56018: JavaScript::Minifier::XS DoS Vulnerability

CVE-2026-56018 Overview

CVE-2026-56018 is a memory leak vulnerability in the Perl module JavaScript::Minifier::XS versions before 0.16. The module leaks memory on every call to minify(), causing unbounded memory growth in long-running processes. The flaw resides in the JsMinify cleanup logic within XS.xs, where per-token contents buffers allocated by JsSetNodeContents are never freed. Additionally, the two early-return paths taken when the node list is empty leak the entire NodeSet structure. Applications such as asset pipelines and server-side minifier endpoints eventually exhaust available memory and are terminated by the operating system. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption).

Critical Impact
Remote attackers can trigger memory exhaustion and denial of service by repeatedly invoking minification endpoints, with no authentication or user interaction required.

Affected Products

JavaScript::Minifier::XS for Perl, versions prior to 0.16
Perl applications and asset pipelines using the affected module
Web services exposing server-side JavaScript minification endpoints

Discovery Timeline

2026-06-29 - CVE-2026-56018 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-56018

Vulnerability Analysis

The vulnerability stems from incomplete cleanup logic in the XS (external subroutine) implementation of the Perl minifier. The JsMinify routine in XS.xs frees only the NodeSet structures during cleanup. It never frees the per-token contents buffers allocated inside JsSetNodeContents. Each call to minify() therefore leaves behind heap allocations that accumulate over the lifetime of the process.

A secondary leak occurs in two early-return code paths triggered when the node list is empty. In these cases, the entire NodeSet is leaked in addition to the buffer contents. The JsDiscardNode function compounds the issue by unlinking nodes from the list without freeing their associated content buffers. This design flaw means that every minification operation contributes to permanent memory consumption, regardless of input size or content.

Root Cause

The root cause is missing free() calls for dynamically allocated token contents buffers in the C-level cleanup routines. The XS bindings track allocations at the node level but never propagate deallocation to buffers referenced by those nodes. This is a classic memory management error where ownership semantics between allocation and cleanup routines are misaligned.

Attack Vector

Attackers exploit this flaw by repeatedly submitting JavaScript content to any endpoint that invokes minify() on user-supplied data. A server-side minifier endpoint or asset pipeline processing untrusted input will grow in resident memory on each request. Given enough requests, the process exhausts system memory and is killed by the OS out-of-memory (OOM) handler, producing denial of service. Exploitation requires only network access to a service invoking the vulnerable code path.

No verified exploit code is publicly available. See the GitHub Issue Discussion and the OpenWall OSS Security List for technical background.

Detection Methods for CVE-2026-56018

Indicators of Compromise

Steady, monotonic growth in resident set size (RSS) of Perl worker processes that invoke JavaScript::Minifier::XS
Repeated OOM-killer events in kernel logs targeting Perl processes hosting minifier endpoints
Elevated request rates to asset-pipeline or minification HTTP endpoints preceding memory exhaustion

Detection Strategies

Inventory Perl dependencies for JavaScript::Minifier::XS versions below 0.16 using CPAN manifests or cpanm --info
Correlate process memory metrics with request logs to identify linear memory growth per minify call
Alert on repeated Perl worker restarts driven by memory limits in supervisors such as systemd, uWSGI, or Starman

Monitoring Recommendations

Track RSS and heap usage of long-lived Perl workers with Prometheus node_exporter or equivalent tooling
Monitor /var/log/syslog and dmesg for Out of memory: Killed process entries referencing Perl binaries
Instrument minifier endpoints with request counters and per-request memory delta measurements

How to Mitigate CVE-2026-56018

Immediate Actions Required

Upgrade JavaScript::Minifier::XS to version 0.16 or later on all systems running Perl asset pipelines or minifier services
Restart long-lived Perl worker processes after patching to release accumulated leaked memory
Apply rate limiting and request size caps on any HTTP endpoint that invokes minify() on untrusted input

Patch Information

The fix is released in JavaScript::Minifier::XS version 0.16 on CPAN. The patched release corrects the cleanup logic in XS.xs so that per-token contents buffers and orphaned NodeSet structures are freed. Review the MetaCPAN Release Changes for the full changelog and upgrade guidance.

Workarounds

Configure process supervisors to recycle Perl workers after a fixed number of requests to bound memory growth
Route minification workloads to short-lived worker processes or containers that are destroyed after each batch
Replace JavaScript::Minifier::XS with a pure-Perl alternative such as JavaScript::Minifier until patching is possible

bash

# Upgrade to the patched release using cpanm
cpanm JavaScript::Minifier::XS@0.16

# Verify the installed version
perl -MJavaScript::Minifier::XS -e 'print $JavaScript::Minifier::XS::VERSION, "\n"'