Perl JS::Minifier Fixes: CVE-2026-56027 Segfault and CVE-2026-56028 Memory Leak

Vulnerability Overview CVE-2026-56027: Causes a segmentation fault (SEGFAULT) in Perl when the function is invoked. CVE-2026-56028: Causes a memory leak due to the "contents" buffer of each tokenized Node not being properly freed within the function. Affected Scope CVE-2026-56027: Affects all scenarios where is called. CVE-2026-56028: Affects all scenarios using , potentially leading to memory leaks. Remediation CVE-2026-56027: Resolves the SEGFAULT issue by fixing the prototype function. CVE-2026-56028: Ensures that the "contents" buffer of each tokenized Node is correctly freed with every call. Additional Information Version Updates: - 0.16: 2026-06-28 14:10:28 - 07:00 America/Vancouver - Fixed CVE-2026-56027 and CVE-2026-56028. - Updated automated tests to use "node" instead of "jsl". Other Improvements: - 0.15: 2021-10-15 20:21:23 - 07:00 America/Vancouver - Preserve line breaks during space collapsing. - Optimized memory allocation. - Optimized space collapsing. - Reduced spaces in preserved Perl comments. - Fixed unescaped slashes in character classes. Other Version Updates: - 0.14: 2021-02-06 21:36:30 - 07:00 America/Vancouver - Rewrote test suite to use a single "t" test. - Optimized memory allocation. - Optimized space collapsing. - Fixed issue where space collapsing reduced spaces in preserved Perl comments. - Fixed unescaped slashes in character classes. Other Version Updates: - 0.13: 2020-12-30 21:46:29 - 07:00 America/Vancouver - Cleaned up POD. - Switched to the GZLI author bundle. Other Version Updates: - 0.12: 2020-12-28 08:31:31 - 07:00 America/Vancouver - Switched to GitHub Actions. - Added META links to the GitHub repository and issue tracker. - Switched to B::Zilla. - Bumped the minimum required Perl version to 5.8.1. - Handle ESO template literals. Other Version Updates: - 0.11: 2015-07-27 16:50 PDT - Fixed segfault when attempting to minify non-JavaScript code. Other Version Updates: - 0.10: 2015-06-26 22:46 PDT - Allowed building on older Perl versions. - Lowered minimum Perl version to v5.6.9. - Allowed returning regular expressions from functions. Other Version Updates: - 0.09: 2010-11-02 22:12 PDT - Bumped the minimum required Perl version to 5.8.8. - Provided broader support for JS tests. Other Version Updates: - 0.08: 2010-07-21 21:23 PDT - Used Newx/Safefree for memory management. Other Version Updates: - 0.07: 2010-04-03 23:44 PDT - Switched to Git. Other Version Updates: - 0.06: 2009-08-06 22:08 PDT - Fixed invalid POD sequences. Other Version Updates: - 0.05: 2008-07-16 23:35 PDT - No warning when minimizing to empty. Other Version Updates: - 0.04: 2008-08-28 21:58 PDT - Rebuilt package; incorrect version number in META.yml. Other Version Updates: - 0.03: 2008-08-28 14:46 PDT - Fixed issue when regular expressions followed comments. - Added debug output. Other Version Updates: - 0.02: 2008-06-06 00:16 PDT - Rebuilt package; META.yml was corrupted. Other Version Updates: - 0.01: 2008-05-15 11:11 PDT - Fixed minimization of array subscripts. - First non-development release. Other Version Updates: - 0.01_05: 2007-10-08 22:48 PDT - Not available on Solaris. Other Version Updates: - 0.01_04: 2007-10-17 15:56 PDT - Fixed , as it attempted "use_ok()" before emitting tests. Other Version Updates: - 0.01_03: 2007-10-19 15:47 PDT - "string()" not available on all systems. - Updated Build.PL and XS.pm to indicate Perl 5.006 is required. Other Version Updates: - 0.01_02: 2007-10-16 12:22 PDT - Relocated XS file so that EU::MM correctly picks it up during "perl Makefile.PL". Other Version Updates: - 0.01_01: 2007-10-15 22:11 PDT - Initial public release.

Goal Reached Thanks to every supporter — we hit 100%!

Perl JS::Minifier Fixes: CVE-2026-56027 Segfault and CVE-2026-56028 Memory Leak

More from this source