CVE-2026-56017 Details
Description
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer. The crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service.
A NULL pointer dereference vulnerability has been identified in JavaScript::Minifier::XS versions prior to 0.16 for Perl. The issue arises when the first meaningful token of the input is a slash, causing the application to crash. This occurs because the regular expression versus division disambiguator in the JsTokenizeString function inspects the previous token's last byte to differentiate between a regular expression literal and a division operator. When a slash is the first meaningful token, there is no valid preceding token available, as the traversal back through whitespace and comment nodes exits the node list, resulting in a NULL pointer. The subsequent identifier check attempts to dereference this NULL pointer, leading to a segmentation fault. This crash can be triggered through the public minify() API, making it possible to cause a denial-of-service condition by sending a remote request that includes a single slash byte.
Users can upgrade to JavaScript::Minifier::XS version 0.16 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/06/29/16 | CVE |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| JavaScript::Minifier::XS | < 0.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CVE |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | CPANSec |