---
title: "GHSA-vc2v-76pw-4v95: compression vulnerable to Denial of Service via memory leak on premature response close"
description: "High severity. compression vulnerable to Denial of Service via memory leak on premature response close. Affects compression; fixed in 1.8.2."
url: https://inlinr.com/advisories/GHSA-vc2v-76pw-4v95
lang: en
---

[Packages](https://inlinr.com/packages) / [compression](https://inlinr.com/packages/compression) / [Security](https://inlinr.com/packages/compression/security)

High Vulnerability GHSA-vc2v-76pw-4v95 CVE-2026-87776 Published 5 Oct 2026

# compression vulnerable to Denial of Service via memory leak on premature response close

Your version 

Affected releases · [compression](https://inlinr.com/packages/compression)

- 1.x 1.0.0 – 1.8.1 Fixed in 1.8.2

On 1.x, the newest line:

```
npm install compression@1.8.2
```

Every release on a timeline

1. Affected

1.0.0 – 1.8.1  
39 releases
2. Fixed

1.8.2  
1 release, latest

40 stable releases of compression, oldest to newest.

## What happens

Impact

A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.

Patches

Users should upgrade to `1.8.2`.

Workarounds

None.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95 "https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95")  
github.com/expressjs/compression/security/advis…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-87776 "https://nvd.nist.gov/vuln/detail/CVE-2026-87776")  
nvd.nist.gov/vuln/detail/CVE-2026-87776
- [Fix commit](https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff "https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff")  
151f63e
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/compression "https://github.com/expressjs/compression")  
github.com/expressjs/compression
- [Reference](https://github.com/expressjs/compression/releases/tag/v1.8.2 "https://github.com/expressjs/compression/releases/tag/v1.8.2")  
github.com/expressjs/compression/releases/tag/v…