CVE-2026-40931
High · 8.4CVSS
8.4
EPSS
0.2%
Published
Apr 21, 2026
CISA due date
—
The record
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | compressing | 0 | 1.10.5 |
| npm | compressing | 2.0.0 | 2.1.1 |
Related vulnerabilities
- GHSA-4c3q-x735-j3r5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing Same vulnerability
- CVE-2026-24884 Compressing is a compressing and uncompressing lib for node. Also affects compressing
- GHSA-cc8f-xg8v-72m3 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction Also affects compressing
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59