DEBIAN-CVE-2026-56017
JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whitespace and comments before it, there is no valid preceding token: the walk back over whitespace and comment nodes runs off the head of the node list to NULL, and the byte lookup reads through a NULL contents pointer at an underflowed length index. The following identifier check dereferences the same NULL pointer. The crash is reachable through the public minify() API, so input as small as a single slash byte crashes the calling process. A service that minifies untrusted or third-party JavaScript can be crashed by a remote request, causing denial of service.
DEBIAN-CVE-2026-56017
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-56017
libjavascript-minifier-xs-perl
Source reference: /affected/0/package/name
- Affected versions
- 0.15-1
Source reference:
/affected/0/versions0.16-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
libjavascript-minifier-xs-perl
Source reference: /affected/1/package/name
- Affected versions
- 0.15-1
Source reference:
/affected/1/versions0.16-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
libjavascript-minifier-xs-perl
Source reference: /affected/2/package/name
- Affected versions
- 0.15-1
Source reference:
/affected/2/versions - Fixed versions
- 0.16-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libjavascript-minifier-xs-perl",
"purl": "pkg:deb/debian/libjavascript-minifier-xs-perl?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"0.15-1",
"0.16-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56017.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libjavascript-minifier-xs-perl",
"purl": "pkg:deb/debian/libjavascript-minifier-xs-perl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.15-1",
"0.16-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56017.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.16-1"
}
]
}
],
"package": {
"name": "libjavascript-minifier-xs-perl",
"purl": "pkg:deb/debian/libjavascript-minifier-xs-perl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.15-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56017.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57968 · Revision 1
- Added to Heist Feed
- Publisher date