compression
Express.js middleware that compresses HTTP responses using gzip or deflate based on the client's Accept-Encoding header. Reduces response payload size by 60-90% for text-based content (JSON, HTML, CSS, JS), improving page load times and reducing bandwidth costs. Part of the expressjs GitHub organization. The standard compression solution for Express.js applications — applied globally, it compresses all compressible responses automatically.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
BREACH attack risk when compressing HTTPS responses mixing secrets with user input — use filter to disable compression for sensitive endpoints. Otherwise minimal security surface.
⚡ Reliability
Best When
You have an Express.js API or server with significant text-based response payloads (JSON APIs, HTML pages) and want easy compression with minimal configuration.
Avoid When
You're in production at scale — use nginx, Cloudflare, or AWS CloudFront compression instead, which is more efficient than Node.js-level compression.
Use Cases
- • Compress API JSON responses in Express.js to reduce bandwidth and improve client response times
- • Enable gzip compression for static file serving in Express.js development servers
- • Reduce transfer size of large JSON payloads in agent API responses for faster client processing
- • Add response compression to Express.js APIs to reduce costs in bandwidth-billed cloud deployments
- • Improve Time-to-First-Byte for React SSR or MPA Express.js applications by compressing HTML responses
Not For
- • Production high-traffic APIs — use nginx or CDN-level compression for production; Node.js-level compression adds CPU overhead per request
- • Already-compressed content (images, videos, binary) — compression middleware automatically skips these MIME types
- • Non-Express frameworks — for Fastify use @fastify/compress; for Koa use koa-compress
Interface
Authentication
No authentication — HTTP middleware.
Pricing
Fully free, MIT licensed.
Agent Metadata
Known Gotchas
- ⚠ Node.js-level compression adds CPU overhead — for high-traffic production, use nginx or CDN compression instead; reserve this for development or low-traffic scenarios
- ⚠ Compression doesn't work with res.write()/res.flush() streaming patterns — compression buffers response; for SSE/streaming use filter option to disable per route
- ⚠ Threshold option: by default, responses < 1KB are not compressed — adjust threshold option if you need to compress smaller responses
- ⚠ Don't compress already-compressed content — images (PNG, JPEG), videos, and binary files are auto-excluded by default MIME type filter
- ⚠ BREACH attack: compressing secrets alongside user-controlled data in HTTPS responses can leak secrets — don't compress responses that mix secrets with user input
- ⚠ Compression doesn't support Brotli (br) — only gzip and deflate; modern clients prefer Brotli for better compression ratios; use shrink-ray-current for Brotli support
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for compression.
Scores are editorial opinions as of 2026-03-06.