CVE-2026-24884: Compressing Package Vulnerable to Arbitrary File Write via Symlink Extraction
Summary
CVE-2026-24884: Compressing Vulnerable to Arbitrary File Write via Symlink Extraction. Affects compressing across 2 version ranges.
< 1.10.4
>= 2.0.0, < 2.0.1
Fixed in 1.10.4 or 2.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'compressing' npm package is designed to handle the extraction of various archive formats, including TAR files. It is widely used in Node.js applications for its ability to manage file compression and decompression efficiently. However, a critical vulnerability has been identified that allows attackers to exploit the package's handling of symbolic links during the extraction process, potentially leading to unauthorized file writes on the host system.
Vulnerability Detail
The vulnerability arises from the 'compressing' package's failure to validate the targets of symbolic links contained within TAR archives. When a TAR file is extracted, the package restores symlinks without checking where they point. This oversight allows an attacker to craft a malicious TAR archive that, when extracted, can redirect file writes to arbitrary locations on the file system. The implications of this vulnerability are severe, as it can lead to overwriting sensitive files, creating files in critical directories, and potentially executing arbitrary code if the extraction is performed with elevated privileges.
How To Fix
Latest published version: 2.1.3 as of 23 Oct 2026
npm install compressing@2.1.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.10.41.10.4npm install compressing@1.10.4 -
>= 2.0.0, < 2.0.12.0.1npm install compressing@2.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid extracting TAR files from untrusted sources or ensure that the extraction is performed in a controlled environment where the potential impact of arbitrary file writes can be mitigated.
Conclusion
The 'compressing' package has a critical vulnerability that allows arbitrary file writes through symlink extraction. Users are strongly advised to update to the latest patched versions to protect their applications from potential exploitation.
See every vulnerability recorded for compressing →
FAQ
CVE-2026-24884 is a vulnerability in the 'compressing' npm package that allows arbitrary file writes via symlink extraction.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to unauthorized file writes, potential code execution, privilege escalation, and data corruption.
You can update the package by running 'npm install compressing@2.0.1' or 'npm install compressing@1.10.4' in your terminal.
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for compressing.
