Skip to content

fix(deps): update dependency compression to v1.8.2 [security] - #540

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-compression-vulnerability
Closed

fix(deps): update dependency compression to v1.8.2 [security]#540
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-compression-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
compression 1.7.4 → 1.8.2 age confidence

compression vulnerable to Denial of Service via memory leak on premature response close

CVE-2026-87776 / GHSA-vc2v-76pw-4v95

More information

Details

Impact

A vulnerability in compression < 1.8.2 allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the connection before the response finishes, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. Repeated aborted requests can exhaust available memory. All applications using compression are affected.

Patches

Users should upgrade to 1.8.2.

Workarounds

None.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

expressjs/compression (compression)

v1.8.2

Compare Source

=====

v1.8.1

Compare Source

=====

v1.8.0

Compare Source

=====

  • Use res.headersSent when available
  • Replace _implicitHeader with writeHead property
  • add brotli support for versions of node that support it
  • Add the enforceEncoding option for requests without Accept-Encoding header

v1.7.5

Compare Source

=====

  • deps: Replace accepts with negotiator@~0.6.4
    • Add preference option
  • deps: bytes@​3.1.2
    • Add petabyte (pb) support
    • Fix "thousandsSeparator" incorrecting formatting fractional part
    • Fix return value for un-parsable strings
  • deps: compressible@~2.0.18
    • Mark font/ttf as compressible
    • Remove compressible from multipart/mixed
    • deps: mime-db@'>= 1.43.0 < 2'
  • deps: safe-buffer@​5.2.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 18, 2026 17:12
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 18, 2026
@renovate
renovate Bot enabled auto-merge (squash) October 18, 2026 17:12
@shcheklein shcheklein mentioned this pull request Oct 21, 2026
Merged
shcheklein added a commit that referenced this pull request Oct 21, 2026
@shcheklein @claude
chore(deps): consolidate dependency updates (#542)
e44442a 
Direct dependencies (exact pins):
- compression 1.7.4 -> 1.8.2 (#540)
- moment 2.29.4 -> 2.31.0 (#539)
- @hapi/wreck 18.0.0 -> 18.1.2 (#537)
- @babel/core 7.20.12 -> 7.29.7 (#536; latest 7.x, includes the 7.29.6 fix)
- lodash 4.17.21 -> 4.18.1 (#531; supersedes #530)
- nanoid ^4.0.0 -> 5.1.16 (#515; now pinned; not imported by site code,
  the theme already uses nanoid 5)
- @svgr/webpack 6.5.1 -> 8.1.0 (#513; the theme's gatsby-plugin-svgr
  already compiled SVGs with 8.1.0)

Transitive (yarn up -R, lockfile only):
- axios 1.12.1 -> 1.20.0 (#534)
- tar 7.4.3 -> 7.5.22 (#532)
- diff 5.1.0 -> 5.2.2 (#528)
- @smithy/config-resolver 4.1.0 -> 4.7.2 (#526)
- express 4.18.2 -> 4.22.3 (#525); express 5 (websites-server) 5.1.0 -> 5.2.1
- js-yaml 3.14.1 -> 3.15.2 (#523); 4.1.0 -> 4.3.2
- tar-fs 2.1.1 -> 2.1.5 (#522); 3.0.4 -> 3.1.3
- brace-expansion 1.1.11 -> 1.1.21 (#520); 2.0.1 -> 2.1.7
- @babel/helpers -> 7.29.10 (#519)
- prismjs 1.29.0 -> 1.30.0 (#517)
- cross-spawn 6.0.5 -> 6.0.6 (#516); 7.0.3 -> 7.0.6
- @babel/runtime -> 7.29.10 (#514)

Lockfile-only pins (yarn set resolution, no package.json resolutions) to
avoid releases younger than 14 days: express@^5.1.0 -> 5.2.1,
@smithy/core@^3.33.2 -> 3.35.1, qs -> 6.16.0, bare-fs -> 4.8.2,
bare-url -> 2.5.4.

Skipped:
- eslint 8 -> 9 (#533): needs a flat-config migration, and
  @typescript-eslint v5, eslint-plugin-react 7.32 and eslint-plugin-jsx-a11y
  6.7 only support eslint <= 8.

Verified locally on Node 22.19.0: yarn install --immutable, build, lint,
lint-ts, lint-css, test, format-check-all, and the production server
(/, /doc, /doc/ref/comment). Rendered HTML is unchanged apart from asset
hashes.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@shcheklein

shcheklein commented Oct 21, 2026

Copy link
Copy Markdown
Member

Superseded by #542, which applies this update (or a newer version) together with the other dependency updates, verified locally.

@shcheklein shcheklein closed this Oct 21, 2026
auto-merge was automatically disabled October 21, 2026 22:44

Pull request was closed

@renovate
renovate Bot deleted the renovate/npm-compression-vulnerability branch October 21, 2026 22:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shcheklein