CVE-2026-87776 · GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
- Risk score
- 63/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed…
- Affected
- compression (npm) < 1.8.2
- Fix
- Upgrade compression to 1.8.2 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| compression | npm | < 1.8.2 | 1.8.2 |
References
- https://github.com/advisories/GHSA-vc2v-76pw-4v95
- https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
- https://nvd.nist.gov/vuln/detail/CVE-2026-87776
- https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/compression/releases/tag/v1.8.2
- https://github.com/advisories/GHSA-vc2v-76pw-4v95
Original description
### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected. ### Patches Users should upgrade to `1.8.2`. ### Workarounds None.
Last activity 5 Oct 2026. Patch Forecast updates every hour.