CVE-2026-87776: Node.js compression middleware DOS flaw

CVE-2026-87776 Overview

CVE-2026-87776 is a memory leak vulnerability [CWE-401] in the compression middleware for Node.js and Express. Versions prior to 1.8.2 fail to destroy the zlib stream when a client aborts a connection while a compressed response is still being transmitted. Each aborted request leaks native zlib memory that the runtime cannot reclaim. A remote, unauthenticated attacker can repeatedly initiate requests and disconnect early to exhaust server memory. The result is a denial-of-service condition that crashes the host process. All applications using the compression package are affected until upgraded to 1.8.2 or later.

Critical Impact
Unauthenticated remote attackers can crash Node.js and Express servers by triggering repeated memory leaks in the zlib compression stream.

Affected Products

compression middleware for Node.js versions prior to 1.8.2
Express applications using the compression package
Any Node.js HTTP service that mounts compression as middleware

Discovery Timeline

2026-09-11 - CVE-2026-87776 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87776

Vulnerability Analysis

The compression middleware wraps outbound HTTP responses in a zlib stream to apply gzip or deflate encoding. When the middleware initializes a compression stream, native memory is allocated inside the zlib binding outside of the V8 heap. Under normal operation, the stream is closed and its native resources are released when the response completes.

The defect appears when a client terminates the TCP connection before the compressed response finishes streaming. The middleware does not invoke a cleanup path for the underlying zlib stream in the aborted state. The stream reference persists, and its native allocations remain resident in process memory. Because the leak occurs in native memory rather than JavaScript heap, Node.js garbage collection cannot reclaim it.

Root Cause

The root cause is missing lifecycle handling for the zlib stream on the response close or aborted events. The middleware only released resources on the end event, which never fires when a client disconnects early. This omission maps directly to CWE-401: Missing Release of Memory after Effective Lifetime.

Attack Vector

An attacker sends HTTP requests to any endpoint served through the compression middleware and closes the socket before the compressed response completes. Repeating this pattern across many concurrent connections causes native memory to grow unbounded until the operating system terminates the Node.js process. No authentication, elevated privileges, or user interaction are required. The attack traffic is indistinguishable from legitimate clients with unstable network conditions, complicating rate-based mitigations.

See the GitHub Security Advisory GHSA-vc2v-76pw-4v95 for maintainer-provided technical details.

Detection Methods for CVE-2026-87776

Indicators of Compromise

Sustained growth in resident set size (RSS) of Node.js processes that does not correlate with active request volume.
Repeated client-initiated connection resets or TCP RST packets against endpoints returning compressed responses.
Node.js process terminations from the operating system out-of-memory (OOM) killer or container memory limit enforcement.

Detection Strategies

Inventory Node.js dependencies with software composition analysis (SCA) tooling to identify compression versions earlier than 1.8.2.
Correlate application performance monitoring (APM) metrics for native memory growth against HTTP access logs showing high volumes of aborted requests.
Alert on abnormal ratios of incomplete responses relative to total HTTP transactions on services that emit compressed payloads.

Monitoring Recommendations

Track process-level memory metrics such as RSS, external memory, and zlib handle counts exposed by process.memoryUsage().
Monitor reverse proxy or load balancer logs for elevated rates of 499 or 408 status codes indicating premature client disconnects.
Set container and orchestrator memory alerts to fire before OOM termination to enable pre-crash forensic capture.

How to Mitigate CVE-2026-87776

Immediate Actions Required

Upgrade the compression package to version 1.8.2 or later across all Node.js applications and container images.
Rebuild and redeploy affected services, then verify the installed version in production using npm ls compression.
Restart long-running Node.js processes to reclaim any memory already leaked by prior exploitation attempts.

Patch Information

The issue is fixed in compression version 1.8.2. The maintainers added stream cleanup on client abort events so that native zlib allocations are released when the connection terminates prematurely. Refer to the OpenJSF Security Advisories and the GitHub Security Advisory GHSA-vc2v-76pw-4v95 for the official fix details.

Workarounds

Disable the compression middleware temporarily and offload response compression to an upstream reverse proxy such as NGINX or a CDN.
Enforce strict per-process memory limits at the container or systemd level so that leaks trigger controlled restarts instead of prolonged degradation.
Deploy a web application firewall (WAF) rule to throttle clients producing high rates of aborted connections against compressed endpoints.

bash

# Upgrade compression to the patched release
npm install compression@^1.8.2
npm ls compression