HIGH
compression
CVE published 2026-09-11
CVE-2026-87776
A remote denial-of-service vulnerability exists in the compression middleware used by Node.js and Express. When a client aborts a connection during a compressed response, the zlib stream is not destroyed, causing a memory leak. Repeated exploitation can lead to memory exhaustion and server crash. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later. This vulnerability has a [truncated]