Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

1.8.2: intermittent HTTP response corruption on keep-alive connections (regression from the CVE-2026-87776 fix)

Aperta
  • Qualcosa non va?
#296 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

@pintu544 ci sta già lavorando.

Dal 16/10/2026.

  • #297 di @pintu544 — aperta

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
8/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
express, javascript, nodejs
Ambito
backend, networking

Direzione di ricerca

The suspected cause is the close listener that 1.8.2 adds to destroy the zlib stream and fall back to the raw response, so start with the diff between 1.8.1 and 1.8.2 in the compression source. There is no minimal repro yet, so the first useful step is building one that combines streamed bodies, client aborts and a keep-alive agent. Done means that repro fails on 1.8.2 and passes on 1.8.1, with the race fixed and the framing verified.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

After upgrading compression 1.8.1 → 1.8.2 (the fix for the client-abort zlib memory leak, CVE-2026-87776), our Express 4 API's integration test suite became reliably flaky: roughly 1 request per ~600 intermittently gets a corrupted or misframed response on keep-alive connections. Pinning back to 1.8.1 — with every other dependency unchanged — makes the suite stable again.

Symptoms observed (varies per occurrence)
  • Error: Parse Error: Expected HTTP/, RTSP/ or ICE/ raised by the Node HTTP client — the bytes on the socket do not start with a status line, i.e. the previous response's framing didn't end where its headers said it would;
  • responses seemingly answered to the wrong request on the socket (a route that must 401 returns 404 or 400, a GET that must 200 returns 404);
  • empty bodies ({} after JSON parsing) on responses that are otherwise 200;
  • socket hang up mid-body.

The failing requests are ordinary JSON endpoints; the suite also exercises streamed responses (image resizing piped through sharp) and requests aborted client-side, which run before/concurrently on the same keep-alive agent.

Evidence (A/B, single variable)

Same app, same Node, same test suite, ~600 HTTP requests per run:

compression runs failing runs
1.8.1 6+ 0
1.8.2 3 3 (1 corrupted response each)

Every other package was held constant during the comparison (we bisected it out of a larger dependency upgrade; morgan and body-parser bumps were cleared separately).

Suspected mechanism

1.8.2 adds a close listener that destroys the zlib stream when the response closes, and falls back to the raw response if the stream is already gone. If that teardown races a response that is still being written on a kept-alive socket (or runs on close of a completed response, since close also fires after normal end), part of the compressed body can be dropped or written raw, so the bytes on the wire no longer match the declared framing — and every subsequent response on that socket is misparsed.

Environment
  • compression 1.8.2 / express 4.22.1 / Node v24.19.0 (macOS, also reproduced with express 4.21.2's stack)
  • Client: node core http with keepAlive: true agents (mocha + chai-http/superagent)

I don't have a minimal standalone repro yet — a naive script (keep-alive agent + aborted compressed responses) didn't trigger it, so the race window seems to need the larger app's timing (streamed bodies + aborts + concurrent sockets). Happy to run instrumented builds or provide more detail from our suite if useful.

Lingua principale
JavaScript
Stelle
2.8k
Fork
260
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di expressjs/compression

Tutte le issue di expressjs/compression

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.