GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
At a glance
- Published
- Updated
- CVE
- CVE-2026-87776
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected. ### Patches Users should upgrade to `1.8.2`. ### Workarounds None.
Affected packages
| Package | Versions |
|---|---|
| npm · compression | introduced 0, fixed 1.8.2 |
References
- https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-87776 ADVISORY
- https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff WEB
- https://cna.openjsf.org/security-advisories.html WEB
- https://github.com/expressjs/compression PACKAGE
- https://github.com/expressjs/compression/releases/tag/v1.8.2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |