Memory Leak in JavaScript Minifier for Perl Affects Asset Pipeline Operations

CVE-2026-56018

What is CVE-2026-56018?

JavaScript::Minifier::XS, prior to version 0.16, contains a vulnerability whereby the minify() function leaks memory on each invocation. This issue arises because the cleanup process fails to free the allocated contents buffers for each token, resulting in unbounded memory growth with repeated calls. If utilized in long-lived processes such as asset pipelines or server-side minification, this can lead to a denial of service as memory consumption escalates unchecked until resources are exhausted.

References