https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:14:24 +0000 https://cve.radiocsirt.org/vuln/cve-2026-56018 <p><strong>Affected:</strong> GTERMARS JavaScript::Minifier::XS</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> <p><strong>Affected:</strong> GTERMARS JavaScript::Minifier::XS</p> <p>JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth.</p> <p>In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token&#39;s contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet.</p> <p>A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.</p> https://cve.radiocsirt.org/vuln/cve-2026-56018