Executive brief
compression is a Node.js middleware that compresses HTTP responses to reduce bandwidth usage. When a client disconnects before receiving a complete compressed response, the compression library fails to clean up its zlib memory, causing a leak. An attacker can exploit this by repeatedly opening and aborting requests, exhausting server memory and causing a service outage.
Technical details
This vulnerability involves a resource leak in the compression middleware where zlib streams are not properly destroyed when HTTP connections are aborted mid-response. The root cause is incomplete cleanup logic that fails to release native zlib memory when a client disconnects prematurely. The attack vector is network-based and requires no authentication or user interaction—any remote client can repeatedly initiate requests and disconnect early to trigger the leak. By exhausting available memory through repeated aborted compressed responses, an attacker can crash the server or degrade its availability. The vulnerability affects all versions before 1.8.2 and is fixed in version 1.8.2 and later.
Affected products
- compression compression <1.8.2
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Version 1.8.2 released