[Pkg-javascript-devel] Bug#1147519: node-compression: CVE-2026-87776

[Salvatore Bonaccorso]

Source: node-compression
Version: 1.8.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-compression.

CVE-2026-87776[0]:
| compression is a Node.js and Express compression middleware. In
| versions before 1.8.2, when a client aborts the connection while a
| compressed response is still being sent, the zlib stream created to
| compress that response is never destroyed, so each aborted
| compressed response leaks its native zlib memory. A remote
| unauthenticated attacker can repeatedly open requests and disconnect
| early, exhausting the available memory and crashing the server. All
| applications using compression are affected. The issue is fixed in
| compression 1.8.2, and users should upgrade to 1.8.2 or later.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-87776
    https://www.cve.org/CVERecord?id=CVE-2026-87776
[1] https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
[2] https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore