Node.js Compression Middleware Vulnerability in Express Framework

CVE-2026-87776

What is CVE-2026-87776?

The compression middleware for Node.js and Express prior to version 1.8.2 contains a vulnerability where an uncleaned zlib stream can lead to memory leaks. This occurs when a client aborts a connection while a compressed response is being sent, leaving the zlib stream active and consuming memory. An unauthenticated attacker can exploit this by repeatedly opening and aborting requests, potentially exhausting server memory and causing crashes. All applications utilizing this middleware are susceptible, necessitating an upgrade to version 1.8.2 or later to mitigate the issue.

References