Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Anyone who can hit your Express app and hang up mid-response can leak zlib memory until the process dies. Upgrade compression to 1.8.2. CVE-2026-87776 https://hol.org/blog/cve-2026-87776-express-compression-zlib-abort-memory-dos https://t.co/5AATRznN54
Post summary
The post alerts users to a memory‑leak DoS vulnerability in Express.js compression that can be mitigated by upgrading to version 1.8.2.
🚨 High-severity security fix in compression@1.8.2 just released! Patches CVE-2026-87776: compression vulnerable to Denial of Service via memory leak on premature response close https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
Post summary
A new patch for [email protected] addresses a high‑severity DoS vulnerability (CVE‑2026‑87776) caused by a memory leak when prematurely closing a response.