The vulnerability in JavaScript::Minifier::XS (prior to version 0.16) involves improper memory management in the JsMinify (XS.xs) component. Specifically, while NodeSet structures are freed during cleanup, the per-token content buffers allocated by JsSetNodeContents are never released. Additionally, JsDiscardNode unlinks nodes without freeing their contents buffers. This results in a memory leak on every call to minify(), and early returns when the node list is empty leak the entire NodeSet. Consequently, long-lived processes that repeatedly invoke minify() experience unbounded memory growth, potentially leading to denial of service due to memory exhaustion.

Unbounded memory growth in affected versions can cause long-running processes using JavaScript::Minifier::XS to exhaust system memory, resulting in process termination and denial of service. There is no indication of remote code execution or data corruption, but service availability is impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions in long-lived processes that repeatedly call minify(), or restart such processes regularly to mitigate memory exhaustion.