CVE-2026-56018— GTERMARS JavaScript::Minifier::XS 资源管理错误漏洞

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

N/A

在移除最后引用时对内存的释放不恰当(内存泄露)

GTERMARS JavaScript::Minifier::XS 资源管理错误漏洞

GTERMARS JavaScript::Minifier::XS是GTERMARS个人开发者的一个JavaScript代码压缩工具。 GTERMARS JavaScript::Minifier::XS 0.16之前版本存在资源管理错误漏洞，该漏洞源于每次调用minify()时清理函数只释放NodeSet结构而不释放每个令牌内容缓冲区，导致内存泄漏，允许无限制的内存增长，可能耗尽可用内存并导致程序被杀死，造成拒绝服务。

N/A

N/A