CVE-2026-40931

CVE-2026-40931 affects the node module compressing up to versions 2.1.0 and 1.10.4/2.0.1 patching CVE-2026-24884. The root cause is a string-based path check in isPathWithinParent that validates resolved paths without accounting for filesystem state, enabling a Directory Poisoning bypass via pre-...

CVE-2026-24884

The CVE-2026-24884 vulnerability affects the npm package compressing (versions ≤ 1.10.3 and 2.0.0) where TAR extraction of symbolic links is performed without validating link targets. This can allow an attacker to cause subsequent archive entries to be written to arbitrary locations on the host f...