Packages / compression / Security

HighVulnerabilityGHSA-vc2v-76pw-4v95CVE-2026-87776Published 5 Oct 2026

compression vulnerable to Denial of Service via memory leak on premature response close

Your version

Affected releases · compression

  • 1.x1.0.0 – 1.8.1Fixed in 1.8.2

On 1.x, the newest line:

npm install compression@1.8.2
Every release on a timeline

  1. Affected

    1.0.0 – 1.8.1

    39 releases

  2. Fixed

    1.8.2

    1 release, latest

40 stable releases of compression, oldest to newest.

What happens

Impact

A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.

Patches

Users should upgrade to 1.8.2.

Workarounds

None.