CVE-2026-87776: compression vulnerable to Denial of Service via memory leak on premature response close
Vulnerability summary
CVE-2026-87776 is a high (CVSS 7.5) vulnerability in compression. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 11-09-2026PublishedVulnerability first disclosed.
- 11-09-2026Last modifiedVulnerability information updated.
Description
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
Decrease -0.13 pp
From 0.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-459Incomplete CleanupThe product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard25 products
- arangodb-3.12< 3.12.12.1-r7
- code-server< 4.140.0-r3
- dotstatsuite-supercore< 3.1.0_git20261001-r4
- eco-jessAll versions (No fix recorded) | < 2026.10.28.40754326399001-r0 | < 2026.10.28.40737702110001-r0
- gitlab-rails-ce-18.10All versions (No fix recorded)
Wolfi6 products
- code-server< 4.140.0-r3
- jupyter-base-notebook< 7.6.3-r2
- serve< 14.2.6-r8
- sqlpadAll versions (No fix recorded)
- thingsboard-tb-web-ui< 4.3.1.5-r7
Compression1 product
- compression< 1.8.2
Debian1 product
- node-compressionAll versions (No fix recorded) | < 1.8.2+~1.8.1-1
Npm1 product
- compression< 1.8.2
Ubuntu1 product
- node-compressionAll versions (No fix recorded)
6 vendors · 35 products
