~ / search / GHSA-vc2v-76pw-4v95

GHSA-vc2v-76pw-4v95

compression vulnerable to Denial of Service via memory leak on premature response close

Source: GitHub Advisory Database (reviewed) High CVE-2026-87776

Packages

EcosystemPackageAffectedFixed in
npm compression < 1.8.2 1.8.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected. ### Patches Users should upgrade to `1.8.2`. ### Workarounds None.

References

External links from the advisory. They lead to third-party sites.