CVE-2026-87776 compression CVE debrief

Who should care

Defenders responsible for Node.js and Express applications should assess exposure and prioritize remediation. System administrators and security teams should be aware of the potential for denial-of-service attacks and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-87776 is a high-severity denial-of-service vulnerability in the compression middleware used by Node.js and Express. Defenders should assess exposure, prioritize remediation, and consider compensating controls to mitigate potential attacks.

• Denial-of-service attacks can cause server crashes and downtime
• Memory exhaustion can lead to performance degradation and instability
• Remote unauthenticated attackers can exploit the vulnerability

Technical summary

The compression middleware used in Node.js and Express is vulnerable to a denial-of-service attack. When a client aborts a connection during a compressed response, the zlib stream is not destroyed, causing a memory leak. This can be exploited by a remote unauthenticated attacker to crash the server by repeatedly opening requests and disconnecting early. The vulnerability has a high CVSS score of 7.5, indicating a high severity. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later. The vulnerability affects applications using compression, and defenders should assess exposure and prioritize remediation.

Defensive priority

Upgrade to compression 1.8.2 or later to fix the memory leak issue. Assess exposure for applications using compression and prioritize remediation.

Recommended defensive actions

• Upgrade to compression 1.8.2 or later
• Assess exposure for applications using compression
• Prioritize remediation for high-risk deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The OpenJSF CNA and ExpressJS GitHub advisory offer additional context. The issue is caused by the zlib stream not being destroyed when a client aborts a connection during a compressed response. This results in a memory leak that can be exploited by a remote unauthenticated attacker. The vulnerability has a high CVSS score of 7.5, indicating a high severity. Defenders should verify affected scope, severity, and vendor guidance. The CVE record was published on 2026-09-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.