Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

published 2026-04-17 6 mo ago modified 2026-10-26 13 d ago also GHSA-4c3q-x735-j3r5 , EUVD-2026-24488

cvss: 8.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 17%
public exploits: 0; none known

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.

Patch / fix

fixed in 2

npm compressing 1.10.5, 2.1.1
node-modules compressing 1.10.5, 2.1.1

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 6 mo ago (2026-04-22)

Exploit prediction

0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	compressing	>=2.0.0, <2.1.1 <1.10.5	2.1.1 1.10.5

Affected products

node-modules compressing

Classification

Weakness

CWE-59 Improper Link Resolution Before File Access

References

github.com /node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5
exploit, web, mitigation, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-40931
advisory
github.com /node-modules/compressing
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary