CVE-2026-40931General(node-modules / compressing)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch node-modules compressing systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.

node-modules CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-59

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

compressing

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-04-26); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

node-modules

Products

compressing

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

General

360.0%

Disclosure

240.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-21	1	Disclosure1
2026-04-26	2	General2
2026-06-02	1	General1
2026-06-03	1	Disclosure1

Full discourse5 posts

DFIR Radar@DFIR_Radar129d
General
Researchers bypass CVE-2026-24884 patch in Node.js compressing library via directory poisoning attacks. New CVE-2026-40931 exploits Git symlinks to achieve arbitrary file writes outside extraction directories in CI/CD pipelines. #DFIR_Radar https://t.co/4Vv47kvs04
Post summary
The tweet informs that researchers found ways to bypass a patch in the Node.js compression library and use Git symlinks for arbitrary file writes in CI/CD pipelines, but no exploit code or active attacks are reported.
12031165
1.8K followersView on X
sachin patil@sachinpatilweb170d
Disclosure
Thrilled to announce my first CVE: CVE-2026-40931 (CVSS 8.4)! Discovered a patch bypass in 'compressing' Node.js lib, leading to Arbitrary File Write via Git-delivered poisoning. Huge thanks to @BuildAndDeploy Write-up soon! ✍️ #CVE #Infosec #NodeJS #BugBounty #SupplyChain https://t.co/gxbI8Kdo5R
Post summary
The tweet announces the discovery of CVE-2026-40931, a Node.js library flaw allowing arbitrary file writes via git poisoning, but lacks PoC, exploit details, or active exploitation evidence.
0101076
54 followersView on X
Infoflowcloud@infoflowcloud165d
General
🚨*CVE* CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation with… https://www.cve.org/CVERecord?id=CVE-2026-40931 ----- Traducción: CVE-2026-40931 Com… http://infoflow.cloud`
Post summary
The post merely announces a CVE and references the affected library, but offers no substantive details on exploitation, mitigation, or vulnerability specifics.
0001029
72 followersView on X
CVE@CVEnew165d
General
CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation with… https://www.cve.org/CVERecord?id=CVE-2026-40931
Post summary
The text merely references CVE‑2026‑40931 with a URL and notes a patch for a different CVE, providing no actionable details or evidence of exploitation.
00010181
57.3K followersView on X
UNDERCODE NEWS@UndercodeNews127d
Disclosure
🚨 Silent Supply Chain Break: #CVE-2026-40931 Uncovers a Dangerous Patch Bypass in Nodejs Compressing Library + Video -Fact Checker: ✅: 2 ❌: 1 || 2/3 → Score: 66% ⚖️ -Prediction: 📈 1 Positive | 📉 1 Negative http://undercodenews.com/silent-supply-chain-break-cve-2026-40931-uncovers-a-dangerous-patch-bypass-in-nodejs-compressing-library-video/
Post summary
The tweet announces a new CVE‑2026‑40931 involving a patch bypass in a Node.js compression library, but provides no technical details or evidence of exploitation or mitigation.
0000038
881 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	node-modules	compressing	-	node.js	-

Explore more

Back to dashboard node-modules CVEs compressing vulnerabilities

What researchers are saying

CVE-2026-40931

DFIR Radar[verified]@DFIR_RadarGeneral

The tweet informs that researchers found ways to bypass a patch in the Node.js compression library and use Git symlinks for arbitrary file writes in CI/CD pipelines, but no exploit code or active attacks are reported.

UNDERCODE NEWS[verified]@UndercodeNewsDisclosure

The tweet announces a new CVE‑2026‑40931 involving a patch bypass in a Node.js compression library, but provides no technical details or evidence of exploitation or mitigation.

sachin patil@sachinpatilwebDisclosure

The tweet announces the discovery of CVE-2026-40931, a Node.js library flaw allowing arbitrary file writes via git poisoning, but lacks PoC, exploit details, or active exploitation evidence.

Infoflowcloud@infoflowcloudGeneral

The post merely announces a CVE and references the affected library, but offers no substantive details on exploitation, mitigation, or vulnerability specifics.

CVE@CVEnewGeneral

The text merely references CVE‑2026‑40931 with a URL and notes a patch for a different CVE, providing no actionable details or evidence of exploitation.