CVE-2026-87776
Received Received - Intake

Memory Leak in Node.js Compression Middleware

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: openjs

Description
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-87776
EUVD
EUVD-2026-76072

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the npm package 'compression' versions before 1.8.2. When a client aborts a connection during a compressed response, the zlib stream used for compression is not destroyed, causing a memory leak. Repeated aborted requests can exhaust system memory and crash the server.

Detection Guidance

To detect this vulnerability, monitor for memory exhaustion or crashes in your Node.js application using compression middleware. Check for repeated aborted connections during compressed responses. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage spikes. Examine application logs for frequent client disconnections during response transmission.

Impact Analysis

An attacker can repeatedly open requests and disconnect early, exhausting available memory and crashing the server. This leads to a Denial of Service (DoS), making the application unavailable to legitimate users.

Mitigation Strategies

Immediately upgrade the 'compression' npm package to version 1.8.2 or later. Update your package.json and run 'npm update compression' or 'npm install compression@latest'. Restart your Node.js application to apply the fix. Ensure no older versions remain in your dependencies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart