CVE-2026-40931

OVERVIEW CVE-2026-40931 affects the Compressing Node.js library versions prior to 2.1.1 and 1.10.5. The vulnerability stems from an incomplete patch to CVE-2026-24884 that employs only logical string validation in the isPathWithinParent utility. This allows attackers to bypass path traversal protections through a Directory Poisoning technique by exploiting pre-existing symbolic links, creating a divergence between the logical path validation and the actual filesystem state. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low complexity, and low privilege requirements. An attacker with local access and no user interaction needed can achieve high impact across confidentiality, integrity, and availability. The attack is straightforward to execute once symbolic links are positioned on the target system, presenting a credible risk to systems running affected versions. EXPLOITATION STATUS There is no indication of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence tracking lists. The EPSS score of 0.00014 suggests minimal current exploit activity compared to other disclosed vulnerabilities. However, the logical nature of the flaw and low attack complexity indicate that exploitation remains feasible and organizations should prioritize patching to versions 2.1.1 or 1.10.5.