CVE-2026-87776

A flaw was found in the compression Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).

Red Hat has rated this vulnerability as Important. A remote unauthenticated attacker can cause a denial of service by repeatedly aborting connections while compressed responses are being sent, which can lead to memory exhaustion and server termination.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Update the compression middleware to version 1.8.2 or later. No supported workaround is currently available if the affected version cannot be updated.