Denial of Service Vulnerability in JavaScript Minifier for Perl by GTERMARS

CVE-2026-56017

What is CVE-2026-56017?

A vulnerability exists in JavaScript::Minifier::XS prior to version 0.16 for Perl, where a NULL pointer dereference occurs when the first meaningful token of the input is a slash. This is due to the regexp versus division disambiguator in JsTokenizeString failing to locate a valid preceding token if the input is only whitespace or comments before the slash token. As a result, a crash can be triggered via the public minify() API, allowing an attacker to cause a denial of service by sending malicious inputs, even as simple as a single slash. This vulnerability can be exploited by untrusted or third-party JavaScript minification services.

References