Vulnerability in Node-Modules Compressing
CVE-2026-40931
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (11.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 11.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.002 · change: -0.000
Affected products
- Node-Modules Compressing — versions >=2.0.0, < 2.1.1, < 1.10.5
Weakness classification (CWE)
References
- github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5 (Exploit, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-40931?
- CVE-2026-40931 is a high-severity vulnerability in Node-Modules Compressing, classified under Improper Link Resolution Before File Access. CVSS score: 8.4/10. Published 2026-04-21.
- How severe is CVE-2026-40931?
- High severity. CVSS v3 base score is 8.4 out of 10.