@naturalcycles/backend-lib 9.69.0 → 9.70.1

package/dist/admin/secureHeaderMiddleware.js

@@ -19,6 +19,7 @@ function requireSecureHeaderOrAdmin(cfg, reqPermissions) {
         // Header provided - don't check for Admin
         if (providedHeader) {
             if (!secureHeaderValue || timingSafeStringEqual(providedHeader, secureHeaderValue)) {
+                req.isAuthenticatedAdminRequest = true;
                 return next();
             }
             return next(new AppError('secureHeader or adminToken is required', {

package/dist/server/compressionMiddleware.js

@@ -64,6 +64,7 @@ export function compressionMiddleware(options) {
         let length;
         let listeners = [];
         let stream;
+        let closed = false;
         const _end = res.end;
         const _on = res.on;
         const _write = res.write;
@@ -126,6 +127,17 @@ export function compressionMiddleware(options) {
             addListeners(res, _on, listeners);
             listeners = null;
         }
+        // Release the compression stream when the response closes, freeing native
+        // zlib memory even if the client disconnected before the response finished.
+        // Registered before onHeaders so a close that happens before the stream
+        // exists is not missed (the `closed` flag below handles a stream created
+        // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+        // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+        // because our Node target frees the zlib handle on destroy().
+        _on.call(res, 'close', function onResponseClose() {
+            closed = true;
+            stream?.destroy();
+        });
         onHeaders(res, function onResponseHeaders() {
             // determine if request is filtered
             if (!filter(req, res)) {
@@ -184,6 +196,14 @@ export function compressionMiddleware(options) {
             else {
                 stream = zlib.createDeflate(zlibOpts);
             }
+            // The response already closed before the stream was created, so the close
+            // listener above has already run. Release the stream now and drop the
+            // reference so later writes fall back to the raw response.
+            if (closed) {
+                stream.destroy();
+                stream = undefined;
+                return;
+            }
             // add buffered listeners to stream
             addListeners(stream, stream.on.bind(stream), listeners);
             // header fields

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.69.0",
+  "version": "9.70.1",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",

package/src/admin/secureHeaderMiddleware.ts

@@ -44,6 +44,7 @@ function requireSecureHeaderOrAdmin(
     // Header provided - don't check for Admin
     if (providedHeader) {
       if (!secureHeaderValue || timingSafeStringEqual(providedHeader, secureHeaderValue)) {
+        req.isAuthenticatedAdminRequest = true
         return next()
       }
 

package/src/server/compressionMiddleware.ts

@@ -113,6 +113,7 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
     let length: number | undefined
     let listeners: [string, (...args: any[]) => void][] | null = []
     let stream: zlib.Gzip | zlib.Deflate | zlib.BrotliCompress | zlib.ZstdCompress | undefined
+    let closed = false
 
     const _end = res.end
     const _on = res.on
@@ -199,6 +200,18 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
       listeners = null
     }
 
+    // Release the compression stream when the response closes, freeing native
+    // zlib memory even if the client disconnected before the response finished.
+    // Registered before onHeaders so a close that happens before the stream
+    // exists is not missed (the `closed` flag below handles a stream created
+    // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+    // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+    // because our Node target frees the zlib handle on destroy().
+    _on.call(res, 'close', function onResponseClose() {
+      closed = true
+      stream?.destroy()
+    })
+
     onHeaders(res, function onResponseHeaders() {
       // determine if request is filtered
       if (!filter(req, res)) {
@@ -268,6 +281,15 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
         stream = zlib.createDeflate(zlibOpts)
       }
 
+      // The response already closed before the stream was created, so the close
+      // listener above has already run. Release the stream now and drop the
+      // reference so later writes fall back to the raw response.
+      if (closed) {
+        stream.destroy()
+        stream = undefined
+        return
+      }
+
       // add buffered listeners to stream
       addListeners(stream, stream.on.bind(stream), listeners!)