Description

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T12:16:52.530Z",
  "pubdate": "2026-09-11T12:16:52.530Z",
  "executiveSummary": "The Node.js and Express 'compression' middleware library is subject to a severe denial-of-service vulnerability due to improper resource management. In versions prior to 1.8.2, the package fails to deallocate memory properly when a client terminates an HTTP connection prematurely while a compressed response is still being sent.\nThis flaw allows a remote, unauthenticated attacker to exploit the system by opening multiple concurrent requests and disconnecting early. Because the zlib stream is never destroyed in these scenarios, each aborted request leaks native zlib memory directly on the host system.\nAccumulated over time, these leaks exhaust available system memory, leading to severe performance degradation and eventually crashing the Node.js process. All applications utilizing affected versions of the compression middleware are vulnerable, making timely remediation critical to maintaining service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in the lifecycle management of native zlib compression streams within the 'compression' middleware. In vulnerable versions prior to 1.8.2, the middleware does not properly handle client disconnection events, such as socket termination, while writing compressed response data.\nWhen a client requests compressed content, the middleware instantiates a native zlib stream to compress the payload. In a normal request-response cycle, the stream is closed and cleaned up upon completion. However, if the client aborts the connection mid-transmission, the middleware's logic fails to trigger the cleanup sequence, leaving the zlib stream active.\nBecause Node.js zlib bindings utilize native C++ memory allocations outside of the V8 JavaScript heap, these resources are not subject to standard JavaScript garbage collection. If the stream's destroy method is not explicitly invoked, the native memory allocation persists indefinitely in system RAM.\nAn attacker can exploit this behavior by systematically initiating requests for compressed assets and abruptly closing the connections. This forces the server to allocate new zlib streams that are never freed, rapidly depleting host memory. The resulting resource exhaustion inevitably triggers an Out-Of-Memory (OOM) error, crashing the server process."
}