Loading story…
Security disclosures identified three vulnerabilities in widely used Perl minifier modules, including two denial-of-service flaws in JavaScript::Minifier::XS and a memory leak in CSS::Minifier::XS. CVE-2026-56017 affects JavaScript::Minifier::XS versions before 0.16 and can crash a calling process when the first meaningful token in input is a slash, triggering a NULL pointer dereference and out-of-bounds read through the public minify() API. CVE-2026-56018 also affects versions before 0.16, causing a memory leak on every minify() call that can drive unbounded memory growth in long-lived services that process untrusted or third-party JavaScript.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A security notice disclosed CVE-2026-13593 affecting CSS::Minifier::XS versions before 0.14 for Perl. The flaw is a memory leak in minify() when the entire document is removed during minification, and users were advised to upgrade to version 0.14 or later.
A security notice disclosed CVE-2026-56018 affecting JavaScript::Minifier::XS versions before 0.16 for Perl. The bug causes a memory leak on every call to minify(), enabling unbounded memory growth in long-lived processes, and users were advised to upgrade to version 0.16 or later.
A security notice disclosed CVE-2026-56017 affecting JavaScript::Minifier::XS versions before 0.16 for Perl. The flaw can crash the calling process when the first meaningful token of input is a slash, and users were advised to upgrade to version 0.16 or later.
On 2026-06-28, JavaScript::Minifier::XS version 0.16 was released. The release fixes CVE-2026-56017, a segfault/NULL pointer dereference issue in minify(), and CVE-2026-56018, a memory leak in minify().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcemetacpan.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
Security advisories disclosed **CVE-2024-14031** and **CVE-2024-14030** in the Perl packages **`Sereal::Encoder`** and **`Sereal::Decoder`**, affecting versions **4.000 through 4.009_002**. Both modules embed a vulnerable version of the **Zstandard (`zstd`)** library and inherit **CVE-2019-11922**, a buffer overwrite flaw in one-pass compression functions present in zstd versions prior to **1.3.8**. The underlying issue is a race condition that can trigger **out-of-bounds writes** when an undersized output buffer is used, and the advisories classify the exposure as **CWE-1395: dependency on a vulnerable third-party component**. Maintainers advised users to upgrade both Perl modules to **version 4.010 or later** to remove the vulnerable bundled library.
Jun 29, 2026
The Perl `DBI` project released a series of updates that fixed multiple security flaws across `DBI` and related components including `DBI::SQL::Nano`, `DBD::File`, and `DBI::ProfileData`. The changelog for versions `1.648`, `1.650`, and `1.651` lists fixes for `CVE-2026-9698`, `CVE-2026-10879`, `CVE-2026-14380`, `CVE-2026-14739`, `CVE-2026-14740`, `CVE-2026-15043`, `CVE-2026-15392`, `CVE-2026-60081`, and `CVE-2026-60082`, reflecting a broad hardening effort across the database interface stack. The patched issues include code injection, out-of-bounds reads, buffer and stack overflows, path traversal or symlink problems, and limits around placeholder parsing. One of the referenced weakness classes is **CWE-134**, `Use of Externally-Controlled Format String`, underscoring the memory-safety and input-handling risks addressed in the releases. Organizations using Perl applications that depend on `DBI` or its file- and SQL-related modules should prioritize upgrading to the latest fixed versions and review exposed components for unsafe input handling and file access patterns.
Jul 14, 2026