CVE-2026-87776: Compression Package Denial of Service via Memory Leak on Premature Response Close
Summary
CVE-2026-87776: compression vulnerable to Denial of Service via memory leak on premature response close. Affects compression versions < 1.8.2. Fixed in 1.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The compression package, utilized in Node.js applications, provides middleware for compressing HTTP responses. It enhances performance by reducing the size of the data sent over the network. However, versions prior to 1.8.2 are susceptible to a Denial of Service (DoS) vulnerability that can be exploited by attackers to exhaust server memory.
Vulnerability Detail
A vulnerability in the compression package versions below 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting from the server while a compressed response is being sent. When a client aborts the connection before the response is fully transmitted, the zlib stream responsible for compressing that response is not destroyed, leading to a memory leak. Repeatedly aborting requests can eventually exhaust the server's available memory, causing it to become unresponsive.
How To Fix
Latest published version: 1.8.2 as of 23 Oct 2026
npm install compression@1.8.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no workarounds available for this vulnerability. The best course of action is to upgrade to the patched version as mentioned above.
Conclusion
The compression package vulnerability CVE-2026-87776 poses a significant risk of Denial of Service due to memory leaks when responses are prematurely closed. Upgrading to version 1.8.2 is crucial to mitigate this risk and ensure the stability of your application.
See every vulnerability recorded for compression →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
All versions of the compression package prior to 1.8.2 are affected by this vulnerability.
If you do not update the package, your application remains vulnerable to Denial of Service attacks, which could lead to server downtime and degraded performance.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
