Node.js Compression Middleware Memory Leak on Connection Abort

The compression middleware for Node.js and Express versions before 1.8.2 contains a critical memory leak vulnerability where zlib streams fail to be properly destroyed when clients disconnect during compressed response transmission. This allows remote, unauthenticated attackers to exhaust server memory by repeatedly initiating requests and disconnecting prematurely, ultimately causing denial of service through server crashes. The vulnerability affects all applications using this middleware without exception, making it a widespread risk across Node.js-based web services. The root cause stems from improper resource management (CWE-401) and missing destructors (CWE-459), creating a path for attackers with network access to degrade or eliminate service availability.

While this CVE lacks direct MITRE ATT&CK technique mapping, Casky's 754 security skills leverage Claude's extended reasoning to identify the underlying attack patterns associated with resource exhaustion and denial of service campaigns. Practitioners using Casky would observe findings related to Resource Hijacking and Service Degradation patterns, detecting anomalous connection abort sequences, memory growth correlations with failed compression operations, and statistical clustering of incomplete HTTP streams. The platform would highlight suspicious patterns such as high rates of early disconnections from single or distributed sources, zlib memory allocation spikes in process monitoring data, and failed response compression events—allowing security teams to distinguish legitimate network issues from coordinated exploitation attempts and implement targeted mitigation before complete system failure occurs.