GHSA-vc2v-76pw-4v95: High severity npm/compression vulnerability
Impact
A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.
Patches
Users should upgrade to 1.8.2.
Workarounds
None.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/compressionto a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
compressionto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
All applications using the compression package in versions earlier than 1.8.2 are affected. An attacker can reach the vulnerable behavior remotely without authentication or user interaction.
What does an attacker need to do to trigger the memory leak?
The attacker must request content that is being sent as a compressed response, then abort the connection before that response finishes. Each aborted response leaves its native zlib stream allocated, and repeated requests can exhaust available memory.
Is there a mitigation if an immediate upgrade is not possible?
No workaround is provided. Upgrade the compression package to version 1.8.2.
How can I determine whether an application may be affected?
Check whether the application depends on the npm compression package and whether the installed version is earlier than 1.8.2. Applications using compressed responses with an affected version should be treated as vulnerable.