Summary
compression vulnerable to Denial of Service via memory leak on premature response close
Advisory details
Impact
A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.
Patches
Users should upgrade to 1.8.2.
Workarounds
None.
References
- https://github.com/advisories/GHSA-vc2v-76pw-4v95
- https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
- https://nvd.nist.gov/vuln/detail/CVE-2026-87776
- https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/compression/releases/tag/v1.8.2
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-104874
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
- MEDIUMCVE-2026-88932
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
- MEDIUMCVE-2026-19730
podman quadlet install --replace does not fully replace the old file
- HIGHCVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
- HIGHCVE-2026-69208
Http4s: DigestAuth nonce map grows unbounded
- HIGHCVE-2026-77037
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads