What’s Vulnerable › Vulnerabilities

CVE-2026-40931: Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-21 · updated 2026-10-26
• Weakness: CWE-59

Description

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.

Affected products

• node-modules compressing: before 1.10.5; from 2.0.0 before 2.1.1 — fixed in 1.10.5, 2.1.1

How to fix

Upgrade to a fixed version: node-modules compressing 1.10.5, 2.1.1. Check the vendor advisory for mitigations.

References

• https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5
• https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5

Get alerted when CVE-2026-40931 or the next vulnerability affects your stack