Merge branch 'master' into release/1.8.2

Author: UlisesGascon

HISTORY.md

@@ -1,6 +1,8 @@
 1.8.2
 =====
+
   * Fix [CVE-2026-87776](https://www.cve.org/CVERecord?id=CVE-2026-87776) ([GHSA-vc2v-76pw-4v95](https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95))
+  * deps: add destroy@1.2.0
   * Match `Cache-Control: no-transform` directive case-insensitively
 
 1.8.1

index.js

@@ -19,6 +19,7 @@ var Buffer = require('safe-buffer').Buffer
 var bytes = require('bytes')
 var compressible = require('compressible')
 var debug = require('debug')('compression')
+var destroy = require('destroy')
 var onHeaders = require('on-headers')
 var vary = require('vary')
 var zlib = require('zlib')
@@ -82,6 +83,7 @@ function compression (options) {
     var length
     var listeners = []
     var stream
+    var closed = false
 
     var _end = res.end
     var _on = res.on
@@ -158,6 +160,17 @@ function compression (options) {
       listeners = null
     }
 
+    // Release the compression stream when the response closes, freeing native
+    // zlib resources even if the client disconnected before it finished.
+    // Registered before onHeaders so a close before the stream exists is not
+    // missed; destroy() no-ops safely when no stream was created, and is used
+    // rather than stream.destroy() because destroy() alone leaks the zlib
+    // handle on some Node.js versions.
+    _on.call(res, 'close', function onResponseClose () {
+      closed = true
+      destroy(stream)
+    })
+
     onHeaders(res, function onResponseHeaders () {
       // determine if request is filtered
       if (!filter(req, res)) {
@@ -217,6 +230,15 @@ function compression (options) {
           ? zlib.createBrotliCompress(optsBrotli)
           : zlib.createDeflate(opts)
 
+      // the response already closed before the stream was created, so the
+      // close listener above has already run. Release the stream now and drop
+      // the reference so later writes fall back to the raw response.
+      if (closed) {
+        destroy(stream)
+        stream = null
+        return
+      }
+
       // add buffered listeners to stream
       addListeners(stream, stream.on, listeners)
 

package.json

@@ -17,6 +17,7 @@
     "bytes": "3.1.2",
     "compressible": "~2.0.18",
     "debug": "2.6.9",
+    "destroy": "1.2.0",
     "negotiator": "~0.6.4",
     "on-headers": "~1.1.0",
     "safe-buffer": "5.2.1",

test/compression.js

@@ -173,6 +173,74 @@ describe('compression()', function () {
       .end(function () {})
   })
 
+  // @see https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
+  it('should destroy the compression stream on response close (gzip)', function (done) {
+    assertDestroyedOnClose('createGzip', 'gzip', done)
+  })
+
+  // @see https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
+  it('should destroy the compression stream on response close (deflate)', function (done) {
+    assertDestroyedOnClose('createDeflate', 'deflate', done)
+  })
+
+  // @see https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
+  brotli('should destroy the compression stream on response close (brotli)', function (done) {
+    assertDestroyedOnClose('createBrotliCompress', 'br', done)
+  })
+
+  // @see https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
+  it('should destroy a compression stream created after the response closed', function (done) {
+    var original = zlib.createGzip
+    var stream
+    var cleaned = false
+    // finish once both the server-side assertion has run and the aborted
+    // request has errored; supertest closes the server after the latter
+    var cb = after(2, done)
+
+    Object.defineProperty(zlib, 'createGzip', {
+      configurable: true,
+      value: function () {
+        stream = original.apply(this, arguments)
+        wrapCleanup(stream, function () {
+          cleaned = true
+        })
+        return stream
+      }
+    })
+
+    var server = createServer({ threshold: 0 }, function (req, res) {
+      res.setHeader('Content-Type', 'text/plain')
+      res.once('close', function () {
+        // start an eligible compressed response after the client already left,
+        // so the stream is created after the only close event
+        res.write(Buffer.alloc(128 * 1024))
+        res.end()
+        setImmediate(function () {
+          var err = null
+          try {
+            assert.ok(stream)
+            assert.strictEqual(cleaned, true)
+          } catch (e) {
+            err = e
+          }
+          Object.defineProperty(zlib, 'createGzip', {
+            configurable: true,
+            value: original
+          })
+          cb(err)
+        })
+      })
+      res.destroy()
+    })
+
+    request(server)
+      .get('/')
+      .set('Accept-Encoding', 'gzip')
+      .end(function () {
+        cb()
+      })
+  })
+
   it('should back-pressure when compressed', function (done) {
     var buf
     var cb = after(2, done)
@@ -1007,6 +1075,86 @@ function createServer (opts, fn) {
   })
 }
 
+// Assert that the compression stream is destroyed when the response closes
+// prematurely (client disconnects mid-response), so the native zlib resources
+// are released. The stream is captured by wrapping the zlib factory, as its
+// destroyed state is not observable from the client.
+// @see https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95
+function assertDestroyedOnClose (createName, acceptEncoding, done) {
+  var original = zlib[createName]
+  var stream
+  var cleaned = false
+
+  Object.defineProperty(zlib, createName, {
+    configurable: true,
+    value: function () {
+      stream = original.apply(this, arguments)
+      // Record whichever cleanup method the middleware invokes, so the
+      // assertion holds on old Node.js versions that expose close() but not
+      // destroy()/destroyed.
+      wrapCleanup(stream, function () {
+        cleaned = true
+      })
+      return stream
+    }
+  })
+
+  var server = createServer({ threshold: 0 }, function (req, res) {
+    res.setHeader('Content-Type', 'text/plain')
+    var timer = setInterval(function () {
+      res.write(Buffer.alloc(128 * 1024))
+    }, 5)
+    res.once('close', function () {
+      clearInterval(timer)
+      setImmediate(function () {
+        var err = null
+        try {
+          assert.ok(stream)
+          assert.strictEqual(cleaned, true)
+        } catch (e) {
+          err = e
+        }
+        Object.defineProperty(zlib, createName, {
+          configurable: true,
+          value: original
+        })
+        server.close(function () {
+          done(err)
+        })
+      })
+    })
+  })
+
+  request(server)
+    .get('/')
+    .set('Accept-Encoding', acceptEncoding)
+    .request()
+    .on('response', function (res) {
+      res.once('data', function () {
+        res.destroy()
+      })
+    })
+    .on('error', function () {})
+    .end()
+}
+
+// Wrap the stream's cleanup methods so a test can observe that the middleware
+// released it. destroy() exists from Node.js 8.0.0; older versions (0.8 to
+// 7.x) expose close() instead, so wrap whichever is present.
+function wrapCleanup (stream, onCleanup) {
+  var methods = ['destroy', 'close']
+  methods.forEach(function (name) {
+    var original = stream[name]
+    if (typeof original !== 'function') {
+      return
+    }
+    stream[name] = function () {
+      onCleanup()
+      return original.apply(this, arguments)
+    }
+  })
+}
+
 function createHttp2Server (opts, fn) {
   var _compression = compression(opts)
   var server = http2.createServer(function (req, res) {