zwave-js / zwave-js-ui / 37693373772

13%

push

github

chore(deps): update dependency compression to v1.8.2 (#4849)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [compression](https://redirect.github.com/expressjs/compression) |
[`1.8.1` →
`1.8.2`](https://renovatebot.com/diffs/npm/compression/1.8.1/1.8.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/compression/1.8.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/compression/1.8.1/1.8.2?slim=true)
|

---

### compression vulnerable to Denial of Service via memory leak on
premature response close
[CVE-2026-87776](https://nvd.nist.gov/vuln/detail/CVE-2026-87776) /
[GHSA-vc2v-76pw-4v95](https://redirect.github.com/advisories/GHSA-vc2v-76pw-4v95)

<details>
<summary>More information</summary>

#### Details
##### Impact

A vulnerability in compression `< 1.8.2` allows an attacker to trigger a
Denial of Service (DoS) by disconnecting while a compressed response is
being sent. When the client aborts the connection before the response
finishes, the zlib stream created to compress that response is never
destroyed, so each aborted compressed response leaks its native zlib
memory. Repeated aborted requests can exhaust available memory. All
applications using compression are affected.

##### Patches

Users should upgrade to `1.8.2`.

##### Workarounds

None.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95](https://redirect.github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-87776](https://nvd.nist.gov/vuln/detail/CVE-2026-87776)
-
[https://github.com/expressjs/compression/commit/151f63e91](https://redirect.githu... (continued)

537 of 4566 branches covered (11.76%)

Branch coverage included in aggregate %.

991 of 7044 relevant lines covered (14.07%)

2.2 hits per line