CVE-2026-24884
1 advisory.
npm/compressing CVE-2026-24884: high 8.4, EPSS 0.35%
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
Action: Upgrade compressing to 1.10.4 or later.
npm i compressing@2.0.1npm i compressing@1.10.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.0.1 | - |
| 0 | 1.10.4 | - |
Fixed versions
| 2.0.1 | 1.10.4 |
Sources
- osv: GHSA-cc8f-xg8v-72m3
- https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3
- https://nvd.nist.gov/vuln/detail/CVE-2026-24884
- https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c
- https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361
- https://github.com/node-modules/compressing
CVE-2026-24884 · published · modified · JSON