AIKIDO-2026-509192

TL;DR

The compression middleware creates a native zlib stream to compress each response but never destroys it when the response closes early. When a client aborts the connection mid-response, the stream's native memory is never reclaimed, and a race also leaves streams created after the close event unreleased. Repeated aborted requests to any compressed endpoint accumulate leaked zlib memory until the server runs out of memory and crashes. The fix registers a response close handler that destroys the stream and drops any stream created after close.