compression middleware CVE-2026-87776

Any Express.js application that has mounted the compression middleware (via app.use(compression()) or equivalent route-level usage) and is reachable over a network is vulnerable. No authentication is required - the leak is triggered by the compression middleware processing any response, not by any authenticated or privileged code path. The vulnerability is present in all default configurations of compression <1.8.2; there is no non-default flag or feature that must be enabled. Exploitation is limited to availability impact only (no credential exposure, no code execution). An attacker must be able to open TCP connections to the server, which is trivially satisfied for any internet-facing application.

The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the realistic threat profile: no authentication, no complexity, entirely network-accessible, and trivially automatable. The attack requires only the ability to send HTTP requests and close them early - any HTTP client library can accomplish this in a tight loop. EPSS data was not provided in the available intelligence, and no CISA KEV listing is present; however, the low exploitation barrier and the prevalence of compression in Express deployments means that even a mid-sized operations team in legnica running public-facing Express APIs should treat this as urgent patching work rather than a deferred maintenance item. The impact is strictly availability - no confidentiality or integrity risk - making this a pure service-disruption vulnerability. The absence of a POC reference in the supplied data does not substantially reduce risk, as reproducing the condition requires no reverse engineering: the mechanism is fully described in the advisory.

An attacker sends a high volume of HTTP GET requests with Accept-Encoding: gzip to any publicly accessible endpoint served by a vulnerable Express application, then immediately closes each TCP connection after the response begins streaming. Each aborted response leaks a native zlib allocation; at sufficient request rate (easily achievable with curl --max-time or a simple script), the Node.js process's resident set grows unboundedly until the OS OOM-killer terminates it or the process crashes. No POC has been identified in the provided data, but the technique requires no specialized tooling.