========================================================================
CVE-2026-56018                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-56018
   Distribution:  JavaScript-Minifier-XS
       Versions:  before 0.16

       MetaCPAN:  https://metacpan.org/dist/JavaScript-Minifier-XS
       VCS Repo: https://github.com/bleargh45/JavaScript-Minifier-XS

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on
every call to minify(), allowing unbounded memory growth

Description
-----------
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on
every call to minify(), allowing unbounded memory growth.

In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and
never the per-token contents buffers allocated in JsSetNodeContents;
JsDiscardNode unlinks nodes without freeing their contents. Each
token's contents buffer is therefore leaked on every call, and the two
early returns taken when the node list is empty leak the whole NodeSet.

A long-lived process that minifies repeatedly, such as an asset
pipeline or a server-side minifier endpoint, grows in memory without
bound until it exhausts available memory and is killed, causing denial
of service.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime
- CWE-400 Uncontrolled Resource Consumption

Solutions
---------
Upgrade to JavaScript::Minifier::XS version 0.16 or later.

References
----------
https://github.com/bleargh45/JavaScript-Minifier-XS/issues/10
https://metacpan.org/release/GTERMARS/JavaScript-Minifier-XS-0.16/changes