Bug 2531852 (CVE-2026-87776)

Summary:	CVE-2026-87776 compression: compression: Denial of Service via memory leak on premature response close
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abarbaro, abrianik, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, aruklets, asdas, ataylor, bbrownin, bniver, bparees, brasmith, cdrage, cochase, csuconic, dbruscin, dmayorov, doconnor, dpaolell, dranck, dschmidt, dymurray, eborisov, ehugonne, flucifre, fmariani, ggrzybek, gmalinko, gmeno, gparvin, groman, gtully, hasun, ibolton, ikhan, janstey, jbalunas, jchui, jdelft, jfula, jhe, jlanda, jlledo, jmatthew, jmontleo, jowilson, jprabhak, jraez, jsherman, jupierce, jwong, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, ngough, nyancey, oaljalju, omaciel, ometelka, pantinor, parichar, pdelbell, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rbobbitt, rgemmell, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rstepani, rushinde, sfeifer, sghai, sidsharm, simaishi, slucidi, sostapov, sseago, stcannon, suppawar, syedriko, tasato, tbish, tcunning, teagle, tlavocat, tsedmik, tsze, ttakamiy, vereddy, veshanka, vlaad, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `compression` Node.js and Express middleware. A remote unauthenticated attacker can exploit this vulnerability by repeatedly initiating and then prematurely aborting connections while compressed responses are being sent. This action prevents the zlib stream, used for compression, from being properly destroyed, leading to a memory leak. Over time, this memory exhaustion can cause the server to crash, resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2535181, 2535183, 2535188, 2535192, 2535193, 2535197, 2535178, 2535182, 2535185, 2535190, 2535196, 2535208, 2535211
Bug Blocks:

Description OSIDB Bzimport 2026-09-11 11:41:26 UTC

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. The issue is fixed in compression 1.8.2, and users should upgrade to 1.8.2 or later.

Comment 1 Jon Orris 2026-10-21 13:52:30 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:87004 https://access.redhat.com/errata/RHSA-2026:87004