Phillip9587

An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pipes it into a decompression stream but fails to attach an error listener after reading the body. If a payload contains one valid compressed frame followed by trailing bytes, the application responds normally to the valid frame, but the trailing bytes trigger an error in the finished decoder. This error is re-thrown as an uncaught exception, terminating the process. Since body parsing occurs before routing, any endpoint that parses a body is affected.

This Node.js and Express compression middleware contains a memory leak. When a client aborts a connection while a compressed response is being transmitted, the zlib stream used for compression is not destroyed. A remote unauthenticated attacker can exploit this by repeatedly initiating requests and disconnecting prematurely, leading to the exhaustion of native zlib memory and causing the server to crash. This results in a Denial of Service (DoS), a condition where a service is unavailable to its intended users.

When the parser is configured with an invalid `limit` option value, such as an unparseable string or NaN (Not-a-Number), the request body size check is silently skipped. This occurs because the internal parsing mechanism returns null, causing applications that rely on the `limit` parameter as their primary safeguard to accept arbitrarily large payloads. This can lead to excessive memory and CPU consumption, resulting in a denial of service.