The vulnerability is a NULL pointer dereference in the JavaScript::Minifier::XS Perl XS implementation. It occurs when the first meaningful token in the input is a slash, causing the tokenizer to look back for a preceding token, walk past the head of the node list, and dereference a NULL contents pointer. The crash is triggered through the publicly exposed minify() API, so an attacker can supply a single slash and immediately cause the caller process to terminate. This results in denial of service for any service that uses the module to minify untrusted or third‑party JavaScript.

Affected is the GTERMARS JavaScript::Minifier::XS module. Versions earlier than 0.16 are vulnerable. The upgrade path is to install JavaScript::Minifier::XS 0.16 or later.

The EPSS score is not available and the vulnerability is not included in the CISA KEV catalog. The CVSS score of 7.5 indicates high severity, but the critical outcome is an application crash. If the minifying service runs as a privileged process or exposes the API over the network, the attack vector is remote, allowing an attacker to trigger the crash with a minimal payload. The risk is high in environments where the module is used on untrusted input and there is no process isolation.