CVE-2026-56017

Name of the Vulnerable Software and Affected Versions JavaScript::Minifier::XS versions prior to 0.16

Description A NULL pointer dereference occurs when the first meaningful token of the input is a slash. The issue resides in the JsTokenizeString() function within the XS.xs file, where the regexp versus division disambiguator fails to find a valid preceding token when a slash starts the input (or follows only whitespace and comments). This causes the process to read through a NULL contents pointer, leading to a crash. This can be triggered via the minify() API, allowing a remote attacker to cause a denial of service by sending a request containing a single slash byte to a service that minifies untrusted JavaScript.

Recommendations Update to version 0.16 or later.