CVE-2026-87776

CVE-2026-87776 is a memory leak (CWE-401, CWE-459) in the compression middleware for Node.js and Express: when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so its native memory is never freed. A remote, unauthenticated attacker triggers the flaw simply by repeatedly opening requests and disconnecting early, with each aborted compressed response leaking native zlib memory. The attacker gains a denial of service, because the leaked memory accumulates until the server exhausts available memory and crashes; there is no confidentiality or confidentiality-adjacent impact (CVSS availability-only, A:H). All applications using the compression middleware in versions before 1.8.2 are affected. There is no public proof of concept, the flaw is not in the CISA KEV catalog, and no exploitation is currently known.

What to do: Upgrade the compression package to version 1.8.2 or later and verify the resolved version in your lockfile and dependency tree. Where upgrading is not immediately possible, reduce exposure by rate-limiting or monitoring for repeated early client disconnects, placing buffering proxies in front of the Node server, and alerting on rising process memory usage as an early indicator of exploitation.