CVE-2026-40931 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Attackers can bypass path validation in the compressing library using symlink poisoning to read or modify files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40931?
CVE-2026-40931 is a high-severity path traversal vulnerability in node-modules compressing, published on 21 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.
Weakness: CWE-59
Which versions are affected by CVE-2026-40931?
4 open source packages ship an affected version, including compressing. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
compressing npm | All versions | 1.10.5 |
compressing npm | All versions | 1.10.5 |
compressing npm | From 2.0.0 | 2.1.1 |
compressing npm | From 2.0.0 | 2.1.1 |
Products include Node-Modules Compressing.
How do I fix CVE-2026-40931?
Upgrade compressing to a fixed version for your release line: 1.10.5 or 2.1.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40931 exists.
Other vulnerabilities in node-modules compressing
Sources
Also known as GHSA-4c3q-x735-j3r5.