CVE-2026-24884Disclosure(node-modules / compressing)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch node-modules compressing systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

node-modules CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3

Weakness type (CWE)

CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

compressing

Threat summary

Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 4 classified signals
General: 4 classified signals
Peaked 4d ago at 2 mentions (2026-02-04); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

node-modules

Products

compressing

1 version affected across 1 product

Deep dive

Activity timeline8 mentions / 5d

Signal classification2 categories

Disclosure

450.0%

General

450.0%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-04	2	Disclosure2
2026-04-17	1	General1
2026-04-26	2	General2
2026-06-02	2	Disclosure1General1
2026-06-03	1	Disclosure1

Full discourse8 posts

DFIR Radar@DFIR_Radar129d
Disclosure
Researchers bypass CVE-2026-24884 patch in Node.js compressing library via directory poisoning attacks. New CVE-2026-40931 exploits Git symlinks to achieve arbitrary file writes outside extraction directories in CI/CD pipelines. #DFIR_Radar https://t.co/4Vv47kvs04
Post summary
Researchers bypassed the patch for CVE-2026-24884 using directory poisoning and disclosed a new CVE-2026-40931 that leverages Git symlinks for arbitrary file writes in CI/CD pipelines.
12031165
1.8K followersView on X
BBWriteup@bbwriteup128d
Disclosure
"Uncovering the Blind Spot: Bypassing a Security Patch (CVE-2026–24884) to Achieve Arbitrary File…" by Sachin Patil #InfoSec #CyberSecurity #Hacking #Vulnerability https://infosecwriteups.com/uncovering-the-blind-spot-bypassing-a-security-patch-cve-2026-24884-to-achieve-arbitrary-file-bc385eaa73fa
Post summary
The article announces CVE‑2026‑24884, noting it bypasses an existing security patch to allow arbitrary file manipulation, though no exploit details or PoC are disclosed in the brief excerpt.
0000189
653 followersView on X
DFIR Radar@DFIR_Radar129d
General
Source: https://infosecwriteups.com/uncovering-the-blind-spot-bypassing-a-security-patch-cve-2026-24884-to-achieve-arbitrary-file-bc385eaa73fa?source=rss----7b722bfd1b8d---4
Post summary
Only a link to an article is provided; no concrete details about the CVE are given in the text.
0001057
1.8K followersView on X
Infoflowcloud@infoflowcloud165d
General
🚨*CVE* CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation with… https://www.cve.org/CVERecord?id=CVE-2026-40931 ----- Traducción: CVE-2026-40931 Com… http://infoflow.cloud`
Post summary
The post notes the existence of CVE-2026-40931 for a Node compression library and links to the CVE record, but offers no detailed technical, patch, or exploitation information.
0001029
72 followersView on X
CVE@CVEnew165d
General
CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation with… https://www.cve.org/CVERecord?id=CVE-2026-40931
Post summary
The tweet merely references CVE‑2026‑40931 via a CVE record link and notes an older patch for a related CVE, offering no PoC, exploitation, or detailed technical information.
00010181
57.3K followersView on X
DailyCVE@dailycve174d
General
🔴 npm package compressing, Partial Fix Bypass, #CVE-2026-24884 (critical) https://dailycve.com/npm-package-compressing-partial-fix-bypass-cve-2026-24884-critical/
Post summary
The tweet notes a CVE‑2026‑24884 vulnerability involving an npm package fix bypass but provides no technical details, PoC, or exploitation evidence.
0000041
181 followersView on X
The Hacker Wire@TheHackerWire246d
Disclosure
🟠 CVE-2026-24884 - High Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their t... https://www.thehackerwire.com/vulnerability/CVE-2026-24884/ https://t.co/hvbTdTeqRE
Post summary
The tweet announces a high‑severity CVE (2026‑24884) affecting the Node.js compressing library, where TAR extraction restores symbolic links without validation, potentially enabling path traversal attacks.
0000059
113 followersView on X
CVE@CVEnew246d
Disclosure
CVE-2026-24884 Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links w… https://www.cve.org/CVERecord?id=CVE-2026-24884
Post summary
The text gives a concise technical description of CVE-2026-24884, noting that the Compressing library extracts TAR archives while restoring symbolic links, highlighting a potential vulnerability.
00000170
56.5K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	node-modules	compressing	-	node.js	-
App	node-modules	compressing	2.0.0	node.js	-

Explore more

Back to dashboard node-modules CVEs compressing vulnerabilities

What researchers are saying

CVE-2026-24884

DFIR Radar[verified]@DFIR_RadarDisclosure

Researchers bypassed the patch for CVE-2026-24884 using directory poisoning and disclosed a new CVE-2026-40931 that leverages Git symlinks for arbitrary file writes in CI/CD pipelines.

DFIR Radar[verified]@DFIR_RadarGeneral

Only a link to an article is provided; no concrete details about the CVE are given in the text.

BBWriteup@bbwriteupDisclosure

The article announces CVE‑2026‑24884, noting it bypasses an existing security patch to allow arbitrary file manipulation, though no exploit details or PoC are disclosed in the brief excerpt.

Infoflowcloud@infoflowcloudGeneral

The post notes the existence of CVE-2026-40931 for a Node compression library and links to the CVE record, but offers no detailed technical, patch, or exploitation information.

CVE@CVEnewGeneral

The tweet merely references CVE‑2026‑40931 via a CVE record link and notes an older patch for a related CVE, offering no PoC, exploitation, or detailed technical information.

DailyCVE@dailycveGeneral

The tweet notes a CVE‑2026‑24884 vulnerability involving an npm package fix bypass but provides no technical details, PoC, or exploitation evidence.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a high‑severity CVE (2026‑24884) affecting the Node.js compressing library, where TAR extraction restores symbolic links without validation, potentially enabling path traversal attacks.

CVE@CVEnewDisclosure

The text gives a concise technical description of CVE-2026-24884, noting that the Compressing library extracts TAR archives while restoring symbolic links, highlighting a potential vulnerability.