All vulnerabilities
CVE-2026-87776GHSA-vc2v-76pw-4v95

compression vulnerable to Denial of Service via memory leak on premature response close

compression compressionnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.8.2Fixed versionGitHub
Published11 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

  • 1.8.2compression, npmGitHubnpm install compression@1.8.2
  • 1.8.2compressionCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.

Patches

Users should upgrade to 1.8.2.

Workarounds

None.

Text from GitHub Advisory Database

Affected versions 4

  • compression, npm< 1.8.2GitHub
  • compressionaffected: all versions before 1.8.2CVE List
  • compressionunaffected: 1.8.2CVE List
  • compression, npmfrom first release, fixed in 1.8.2OSV

References 6