CVE-2026-87776

compression vulnerable to Denial of Service via memory leak on premature response close

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

Analysis

Technical impact

The compression middleware creates a zlib stream for each compressed response. If a client aborts the connection while data is still being written, the zlib stream is never destroyed, causing a memory leak (CWE-401), a resource leak (CWE-459), and a missing release of that resource (CWE-772). Over repeated attacks, an unauthenticated attacker can exhaust the process memory and crash the server.

Affected Systems

Any application that includes the compression module before 1.8.2 is vulnerable. The vulnerability affects all Node.js or Express servers that use this middleware for response compression, regardless of internal logic or configuration.

Risk and Exploitability

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1% indicates a low yet non‑zero exploit probability. An attacker can trigger the flaw by opening a request to a compressed endpoint and terminating it early; repeated attempts drain memory and lead to a system‑wide denial of service. The issue is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

compression

unaffected

Version	Status	Constraints
`0`	affected	< 1.8.2
`1.8.2`	unaffected	—

No data.

Vendor Product Versions

Expressjs

Compression

Version	Status	Scheme	Platform
`[0,1.8.2)`	affected	generic	—
`1.8.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the compression middleware to version 1.8.2 or later.
Remove or disable the middleware if compression is not required for the application.
Implement request rate limiting to mitigate abort attacks.

Generated by OpenCVE AI on September 21, 2026 at 04:52 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-vc2v-76pw-4v95	compression vulnerable to Denial of Service via memory leak on premature response close

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.477% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.openjsf.org/security-advisories.html
https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
https://nvd.nist.gov/vuln/detail/CVE-2026-87776
https://www.cve.org/CVERecord?id=CVE-2026-87776

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Expressjs Expressjs compression
Vendors & Products		Expressjs Expressjs compression

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-87776 https://www.cve.org/CVERecord?id=CVE-2026-87776
Metrics	threat_severity `None`	threat_severity `Important`

Sep 11, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 11:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.
Title		compression vulnerable to Denial of Service via memory leak on premature response close
Weaknesses		CWE-401 CWE-459
References		https://cna.openjsf.org/security-advisories.html https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`