CVE-2026-87776: 
Grafana vulnerability analysis and mitigation

CVE-2026-87776 is a Denial of Service vulnerability in the compression Node.js and Express middleware caused by a memory leak when clients prematurely abort connections during compressed response transmission. All versions of the compression package before 1.8.2 are affected. The vulnerability was disclosed on September 11, 2026, with a fix available in version 1.8.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper resource cleanup (CWE-772, CWE-459, CWE-401): when a client disconnects before a compressed HTTP response is fully transmitted, the underlying zlib stream allocated for compression is never destroyed, causing its native memory to leak. An unauthenticated remote attacker can exploit this by repeatedly opening HTTP requests that trigger compressed responses and then aborting those connections before completion. Each aborted request leaks a zlib stream's native memory allocation, and with sufficient repetition, the cumulative leak exhausts available server memory. No special privileges, user interaction, or complex conditions are required — only the ability to send network requests to the server (GitHub Advisory, Red Hat CVE).

Successful exploitation results in progressive memory exhaustion on the affected Node.js/Express server, ultimately causing a process crash and complete loss of service availability. There is no confidentiality or integrity impact — the vulnerability is purely an availability concern. Any application using the compression middleware is affected regardless of its specific configuration, making the blast radius broad across the Node.js/Express ecosystem (GitHub Advisory, Red Hat CVE).

As of the disclosure date (September 11, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and low complexity, making it straightforward to weaponize if targeted.

1. Reconnaissance: Identify internet-facing Node.js/Express applications using the compression middleware (versions < 1.8.2) via passive scanning, package manifest inspection, or HTTP response header analysis (e.g., Content-Encoding: gzip headers).
2. Trigger compressed response: Send an HTTP GET or POST request to an endpoint that returns a compressible response (e.g., JSON or HTML content), ensuring the Accept-Encoding: gzip header is included so the server allocates a zlib stream.
3. Abort the connection prematurely: Immediately close the TCP connection (e.g., using a tool like curl with a timeout, or a custom script) before the server finishes sending the compressed response body, preventing the zlib stream from being properly destroyed.
4. Repeat at scale: Automate steps 2–3 in a loop using tools such as ab (Apache Bench), wrk, or a custom script to send hundreds or thousands of such aborted requests, causing cumulative native zlib memory leaks.
5. Achieve DoS: Continue until the server's available memory is exhausted, causing the Node.js process to crash or become unresponsive, resulting in a denial of service (GitHub Advisory, Red Hat CVE).

• Network: High volume of short-lived TCP connections to the application server that terminate before response completion; repeated requests with Accept-Encoding: gzip or deflate headers from the same or rotating source IPs.
• Logs: Application access logs showing a large number of requests with abrupt connection resets (e.g., ECONNRESET errors) or incomplete response transmissions; Node.js process logs showing increasing memory usage warnings.
• Process: Node.js process exhibiting steadily growing RSS (Resident Set Size) memory consumption over time without corresponding increase in active connections; eventual out-of-memory (OOM) crash or process exit with memory-related error messages.
• System: Operating system-level alerts for high memory utilization on the server hosting the Node.js application; OOM killer events in system logs (e.g., /var/log/syslog or dmesg on Linux).

The primary remediation is to upgrade the compression npm package to version 1.8.2 or later, which properly destroys the zlib stream when a client connection is aborted (GitHub Advisory). The official advisory states there are no workarounds for the underlying vulnerability. As compensating controls, operators can implement connection rate limiting (e.g., via a reverse proxy such as nginx or a WAF), configure request timeouts to limit how long aborted connections persist, and set up memory monitoring and alerting to detect anomalous growth before a crash occurs (Red Hat CVE).

The vulnerability was published by UlisesGascon under the OpenJS Foundation CNA, with credits to bjohansebas (analyst), KKamJi98 (finder), and Phillip9587 (remediation reviewer), indicating coordinated disclosure within the Express.js maintainer community (GitHub Advisory). A community write-up was published on dev.to shortly after disclosure, titled "CVE-2026-87776: Express compression leaks native memory until the process dies," reflecting early community awareness. Red Hat also tracked the issue via Bugzilla (Bug #2531852) and published a CVE entry, suggesting downstream impact assessment for Red Hat products that bundle Node.js (Red Hat CVE).