The compression middleware creates a zlib stream whenever a response is compressed. If a client aborts the connection while the stream is still writing data, the stream is never destroyed, leaving the native zlib memory allocated. Each aborted request therefore adds a small but permanent memory reservation. Over time an attacker can intentionally disconnect many compressed responses and exhaust the process memory, causing the Node.js or Express server to crash. The flaw is-401 and CWE-459.

Any Node.js or Express application that includes the compression middleware in a version earlier than 1.8.2 is vulnerable, regardless of the underlying application logic or server configuration. All applications using this module should be considered affected.

The CVSS score of 7.5 indicates a high risk to availability. EPSS data is not available, so the likelihood of exploitation is unknown, but the vulnerability can be triggered by an unauthenticated HTTP client without additional privileges, and it is not listed in the CISA KEV catalog. The attack requires only a standard request to a compressed endpoint and an early disconnect; successful exploitation results in denial of service for all users of the affected server.