GitHub Advisoryadvisory · npm

GHSA-vc2v-76pw-4v95 compression vulnerable to Denial of Service via memory leak on premature response close

HIGH Published 2026-10-05 Modified 2026-10-05 Official page ↗
Aliases
CVE-2026-87776
Ecosystem
npm
Packages
compression
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401, CWE-459
Reviewed
2026-10-05

Affected packages

• npm compression: < 1.8.2 → fixed in 1.8.2

Description

Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected. Patches Users should upgrade to `1.8.2`. Workarounds None.

Related

Alias · CVE (1)

  • CVE-2026-87776 compression is a Node.js and Express compression middleware. vulnerability

Weakness · CWE (2)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness
  • CWE-459 Incomplete Cleanup weakness

References