CVE-2026-87776 in compression
Summary
by MITRE • 09/11/2026
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified within the Node.js and Express compression middleware prior to version 1.8.2 represents a critical resource management flaw that can lead to service denial through memory exhaustion. This issue stems from improper handling of asynchronous streams during client disconnections, specifically affecting applications that rely on this middleware for gzip or deflate compression of HTTP responses. The core technical defect lies in the lifecycle management of the zlib stream object created by the middleware when processing a response. Under normal operation, these streams are properly terminated and garbage collected once the transmission is complete. However, when a client abruptly terminates the connection while data is still being compressed and transmitted, the event handlers responsible for cleaning up the underlying native zlib resources fail to execute correctly. Consequently, the memory allocated by the C++ layer of Node.js for compression buffers remains reserved but inaccessible, creating a persistent memory leak with each aborted request.
From an operational perspective, this flaw allows for a straightforward remote unauthenticated denial-of-service attack vector. An attacker can exploit this behavior by initiating multiple HTTP requests to endpoints that return compressible content and then immediately closing the TCP connection before the server finishes sending the response. Because each such interaction leaves behind leaked memory in the Node.js heap or native memory space, repeated execution of this pattern causes the application process to consume increasing amounts of system RAM. Eventually, the operating system will either kill the node process due to exceeding memory limits or cause severe performance degradation as the garbage collector struggles with the bloated state. This effectively renders the web service unavailable to legitimate users without requiring any form of authentication or complex exploitation techniques beyond basic network connectivity.
This vulnerability aligns closely with CWE-401, which describes a missing release of memory after effective usage, and specifically relates to improper cleanup procedures in asynchronous operations. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates resource exhaustion attacks often categorized under T1498 Network Denial of Service or more broadly within the impact category of Availability compromise. The attack does not require privilege escalation or code execution but focuses purely on destabilizing the host environment through systematic resource depletion. It highlights a common pitfall in event-driven architectures where connection termination events are not sufficiently propagated to all dependent subsystems, particularly those involving native bindings like zlib.
Mitigation for this vulnerability is straightforward and primarily involves software updates. Organizations running affected versions of the compression middleware must upgrade immediately to version 1.8.2 or any later release where the issue has been resolved by ensuring that cleanup routines are triggered even when connections are aborted prematurely. For environments where immediate patching is not feasible, temporary workarounds may include implementing stricter client-side timeout policies at a reverse proxy level such as Nginx or Apache to prevent long-held open connections from triggering these conditions excessively. Additionally, monitoring memory usage trends in production environments can help detect anomalous growth patterns indicative of this leak before it leads to catastrophic failure. Regular auditing of dependency versions and maintaining an up-to-date inventory of third-party libraries is essential for preventing similar resource management vulnerabilities across the application stack.