compressing vulnerabilities

2 known vulnerabilities in compressing from Node-modules. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  compressing: Improper Link Resolution Before File Access

  CVE-2026-40931Apr 21, 2026Node-modules

  Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with t

• 7.8 High severity

  compressing: Improper Link Resolution Before File Access

  CVE-2026-24884Feb 4, 2026Node-modules

  Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extra