CVE-2026-40931

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5	Exploit Mitigation Vendor Advisory
https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:node-modules:compressing::::::node.js::*
	cpe:2.3:a:node-modules:compressing::::::node.js::*

History

23 Apr 2026, 15:49

Type	Values Removed	Values Added
CPE		cpe:2.3:a:node-modules:compressing::::::node.js::*
First Time		Node-modules Node-modules compressing
References	~~() https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 -~~	() https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 - Exploit, Mitigation, Vendor Advisory

22 Apr 2026, 14:17

Type	Values Removed	Values Added
References	~~() https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 -~~	() https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 -

21 Apr 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-21 22:16

Updated : 2026-04-23 15:49

NVD link : CVE-2026-40931

Mitre link : CVE-2026-40931

CVE.ORG link : CVE-2026-40931

JSON object : View

Products Affected

node-modules

compressing

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-40931", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2026-04-21T22:16:19.247", "references": [{"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this \"Logical vs. Physical\" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5."}], "lastModified": "2026-04-23T15:49:20.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "734A2799-2D6B-48E1-BA28-13633AB1A458", "versionEndExcluding": "1.10.5"}, {"criteria": "cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6445E79F-051C-40AF-A23A-6174BF2B41E8", "versionEndExcluding": "2.1.1", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}