CVE-2026-87776— compression vulnerable to Denial of Service via memory leak on premature response close
Quick assessment
Affected
compression compression
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
是 Node.js 和 Express 的压缩中间件。在 1.8.2 之前的版本中，当客户端在压缩响应尚未发送完毕时中断连接，用于压缩该响应的 zlib 流从未被销毁，导致每个被中断的压缩响应都会泄漏其原生 zlib 内存。一个远程未认证的攻击者可以通过反复发起请求并提前断开连接，耗尽可能可用的内存，从而导致服务器崩溃。所有使用 的应用均受此问题影响。该问题已在 1.8.2 中修复，建议用户升级到 1.8.2 或更高版本。
Possible ATT&CK Techniques 1 AI
T1014 · Rootkit
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87776
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
compression vulnerable to Denial of Service via memory leak on premature response close
Source: CVE Program / CVE List V5
Vulnerability Description
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| compression | compression | 0 ~ 1.8.2 | - |
|
II. Public POCs for CVE-2026-87776
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87776
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87776 (1)
IV. Related Vulnerabilities
Same weakness: CWE-401
V. Comments for CVE-2026-87776
No comments yet