CVE-2026-40931: Node-modules Compressing Path Traversal

CVE-2026-40931 Overview

CVE-2026-40931 is a symlink attack vulnerability affecting the Compressing library for Node.js, a popular compression and decompression utility. The vulnerability exists because the security patch for CVE-2026-24884 implemented a purely logical string validation within the isPathWithinParent utility function. This check verifies if a resolved path string starts with the destination directory string but critically fails to account for the actual filesystem state, creating a "Logical vs. Physical" divergence that attackers can exploit.

By leveraging pre-existing symbolic links on the filesystem (a technique known as Directory Poisoning), an attacker can bypass the path traversal security check and potentially write files outside the intended extraction directory. This vulnerability represents an incomplete fix scenario where the original mitigation was insufficient to address all attack vectors.

Critical Impact

Attackers can bypass path traversal protections using pre-existing symbolic links, potentially leading to arbitrary file write operations outside the intended destination directory with local access.

Affected Products

• node-modules compressing versions prior to 2.1.1
• node-modules compressing versions prior to 1.10.5
• Node.js applications using vulnerable compressing library versions

Discovery Timeline

• April 21, 2026 - CVE-2026-40931 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40931

Vulnerability Analysis

This vulnerability falls under CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack. The root issue stems from the incomplete nature of the patch for CVE-2026-24884. While the original fix introduced path validation through the isPathWithinParent utility function, this validation operates purely on string comparisons of resolved paths rather than verifying the actual filesystem topology.

The vulnerability requires local access to exploit, as the attacker must have the ability to create symbolic links on the target filesystem prior to the decompression operation. Once a malicious symlink is in place, the extraction process can be manipulated to write files to arbitrary locations outside the intended destination directory, potentially overwriting sensitive configuration files or injecting malicious code into application directories.

Root Cause

The fundamental flaw lies in the disconnect between logical path validation and physical filesystem reality. The isPathWithinParent function performs string-based validation by checking if a resolved path begins with the expected destination directory path. However, this approach does not account for symbolic links that may redirect file operations to entirely different filesystem locations.

When a symbolic link exists within the destination directory pointing to an external location, the path resolution returns a string that passes the validation check, but the actual file write operation follows the symlink to an unintended location. This creates a Time-of-Check to Time-of-Use (TOCTOU) style vulnerability where the security decision is made based on string data that does not reflect the true filesystem behavior.

Attack Vector

The attack requires local access and follows a Directory Poisoning methodology. An attacker first creates symbolic links within the target extraction directory (or a path that will become the extraction directory). These symlinks point to sensitive locations outside the intended destination, such as system configuration directories or application code paths.

When a legitimate user or automated process extracts an archive using the vulnerable compressing library, the path validation passes because the resolved path strings appear to be within the destination directory. However, when files are actually written, the filesystem follows the symbolic links, resulting in file writes to the attacker-controlled external locations.

The vulnerability exploitation mechanism leverages pre-existing symlinks to bypass string-based path validation. The isPathWithinParent check compares resolved path strings without verifying actual filesystem topology, allowing writes to follow symlinks outside the intended destination. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-40931

Indicators of Compromise

• Unexpected symbolic links appearing in directories commonly used for archive extraction
• File modification timestamps in system directories that correlate with archive extraction operations
• Presence of the vulnerable compressing library versions (< 2.1.1 or < 1.10.5) in package.json or package-lock.json files
• Log entries showing extraction operations followed by unexpected file changes outside extraction directories

Detection Strategies

• Implement file integrity monitoring on critical system directories and application paths to detect unauthorized modifications
• Audit Node.js application dependencies using npm audit or similar tools to identify vulnerable compressing library versions
• Monitor filesystem operations for symlink creation in commonly used extraction directories
• Review application logs for archive extraction operations and correlate with file system change events

Monitoring Recommendations

• Deploy SentinelOne agents configured to monitor for suspicious symlink creation patterns in application directories
• Enable filesystem auditing on directories where archive extraction commonly occurs
• Implement Software Composition Analysis (SCA) scanning in CI/CD pipelines to catch vulnerable dependencies before deployment
• Set up alerts for package.json changes that introduce or retain vulnerable compressing library versions

How to Mitigate CVE-2026-40931

Immediate Actions Required

• Update the compressing library to version 2.1.1 or later for the 2.x branch
• Update the compressing library to version 1.10.5 or later for the 1.x branch
• Audit applications for any uses of the compressing library and prioritize updates based on exposure
• Review extraction directories for any suspicious symbolic links that may have been placed by attackers

Patch Information

The vulnerability has been addressed in compressing versions 2.1.1 and 1.10.5. The fix improves the path validation logic to properly account for symbolic links in the filesystem, preventing the Directory Poisoning attack vector. Organizations should update to these patched versions as soon as possible.

For detailed patch information and the security advisory, refer to the GitHub Security Advisory GHSA-4c3q-x735-j3r5.

Workarounds

• Ensure extraction directories are created fresh and do not contain pre-existing symbolic links before extraction operations
• Implement application-level checks to verify no symlinks exist in destination directories prior to archive extraction
• Run extraction operations in isolated environments or containers with restricted filesystem access
• Apply the principle of least privilege to processes performing archive extraction operations

# Configuration example
# Update compressing library to patched version
npm update compressing@2.1.1

# Or for 1.x branch
npm update compressing@1.10.5

# Verify installed version
npm list compressing

# Audit for vulnerabilities
npm audit