compression vulnerable to Denial of Service via memory leak on premature response close
### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected. ### Patches Users should upgrade to `1.8.2`. ### Workarounds None.
GHSA-vc2v-76pw-4v95
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-vc2v-76pw-4v95
compression
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.8.2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.2"
}
]
}
],
"package": {
"name": "compression",
"purl": "pkg:npm/compression",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vc2v-76pw-4v95/GHSA-vc2v-76pw-4v95.json"
}
}
]- Related CVEs
- CVE-2026-87776
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #85935 · Revision 1
- Added to Heist Feed
- Publisher date