CVE-2026-87776 compression CVE debrief

Who should care

Defenders and developers using Node.js and Express with compression middleware should assess exposure and prioritize remediation. System administrators and security teams should be aware of the potential denial-of-service risk.

Why it matters

CVE-2026-87776 is a high-severity denial-of-service vulnerability in Node.js and Express compression middleware. Defenders should assess exposure, prioritize remediation, and upgrade to compression 1.8.2 or later to prevent potential server crashes and memory exhaustion.

• Denial-of-service risk due to memory exhaustion
• Potential for server crashes and instability
• Need for upgrade to compression 1.8.2 or later for fix

Technical summary

The compression middleware used by Node.js and Express is vulnerable to a denial-of-service attack. When a client aborts a connection during a compressed response, the zlib stream is not destroyed, causing a memory leak. This can be exploited to exhaust available memory and crash the server. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later to prevent potential server crashes and memory exhaustion. All applications using compression are affected.

Defensive priority

Upgrade to compression 1.8.2 or later to fix the memory leak issue. Assess exposure for applications using compression and prioritize remediation.

Recommended defensive actions

• Upgrade to compression 1.8.2 or later
• Assess exposure for applications using compression
• Prioritize remediation for high-risk deployments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The issue is fixed in compression 1.8.2. Official sources confirm the memory leak and denial-of-service potential. The vulnerability allows a remote unauthenticated attacker to repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. There are no reports of this vulnerability being exploited in the wild.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.