CVE-2026-87776
1 advisory.
npm/compression CVE-2026-87776: high 7.5
compression vulnerable to Denial of Service via memory leak on premature response close
Action: Upgrade compression to 1.8.2 or later.
npm i compression@1.8.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.2 | - |
Fixed versions
| 1.8.2 |
Sources
- osv: GHSA-vc2v-76pw-4v95
- https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
- https://nvd.nist.gov/vuln/detail/CVE-2026-87776
- https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/compression
- https://github.com/expressjs/compression/releases/tag/v1.8.2
CVE-2026-87776 · published · modified · JSON