Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by node-modules
CVE-2026-55553 (GCVE-0-2026-55553)
Vulnerability from nvd – Published: 2026-08-25 16:18 – Updated: 2026-08-25 18:25
VLAI
EPSS
VEX
Title
urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Summary
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 18:25 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/node-modules/urllib/security/a… | x_refsource_CONFIRM |
| https://github.com/node-modules/urllib/pull/812 | x_refsource_MISC |
| https://github.com/node-modules/urllib/pull/813 | x_refsource_MISC |
| https://github.com/node-modules/urllib/commit/7c8… | x_refsource_MISC |
| https://github.com/node-modules/urllib/commit/811… | x_refsource_MISC |
| https://github.com/node-modules/urllib/releases/t… | x_refsource_MISC |
| https://github.com/node-modules/urllib/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | urllib |
Affected:
>= 3.0.0, < 4.9.1
Affected: < 2.44.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55553",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T18:25:35.484065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T18:25:40.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "urllib",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 4.9.1"
},
{
"status": "affected",
"version": "\u003c 2.44.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T16:18:21.519Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"
},
{
"name": "https://github.com/node-modules/urllib/pull/812",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/pull/812"
},
{
"name": "https://github.com/node-modules/urllib/pull/813",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/pull/813"
},
{
"name": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16"
},
{
"name": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46"
},
{
"name": "https://github.com/node-modules/urllib/releases/tag/v2.44.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/releases/tag/v2.44.1"
},
{
"name": "https://github.com/node-modules/urllib/releases/tag/v4.9.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/releases/tag/v4.9.1"
}
],
"source": {
"advisory": "GHSA-hq3h-g68c-hp78",
"discovery": "UNKNOWN"
},
"title": "urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55553",
"datePublished": "2026-08-25T16:18:21.519Z",
"dateReserved": "2026-06-16T23:11:20.213Z",
"dateUpdated": "2026-08-25T18:25:40.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40931 (GCVE-0-2026-40931)
Vulnerability from nvd – Published: 2026-04-21 20:57 – Updated: 2026-04-22 13:52
VLAI
EPSS
VEX
Title
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Summary
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.
Severity
8.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 13:51 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/node-modules/compressing/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | compressing |
Affected:
>=2.0.0, < 2.1.1
Affected: < 1.10.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40931",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T13:51:59.094969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T13:52:42.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compressing",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "\u003e=2.0.0, \u003c 2.1.1"
},
{
"status": "affected",
"version": "\u003c 1.10.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this \"Logical vs. Physical\" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T20:57:09.840Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5"
}
],
"source": {
"advisory": "GHSA-4c3q-x735-j3r5",
"discovery": "UNKNOWN"
},
"title": "Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40931",
"datePublished": "2026-04-21T20:57:09.840Z",
"dateReserved": "2026-04-15T20:40:15.518Z",
"dateUpdated": "2026-04-22T13:52:42.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24884 (GCVE-0-2026-24884)
Vulnerability from nvd – Published: 2026-02-04 19:35 – Updated: 2026-02-05 14:32
VLAI
EPSS
VEX
Title
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
Summary
Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-05 14:23 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/node-modules/compressing/secur… | x_refsource_CONFIRM |
| https://github.com/node-modules/compressing/commi… | x_refsource_MISC |
| https://github.com/node-modules/compressing/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | compressing |
Affected:
= 2.0.0
Affected: < 1.10.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-05T14:23:12.467869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-05T14:32:51.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compressing",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "= 2.0.0"
},
{
"status": "affected",
"version": "\u003c 1.10.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor\u2019s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T19:35:56.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3"
},
{
"name": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c"
},
{
"name": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361"
}
],
"source": {
"advisory": "GHSA-cc8f-xg8v-72m3",
"discovery": "UNKNOWN"
},
"title": "Compressing Vulnerable to Arbitrary File Write via Symlink Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24884",
"datePublished": "2026-02-04T19:35:56.357Z",
"dateReserved": "2026-01-27T19:35:20.527Z",
"dateUpdated": "2026-02-05T14:32:51.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55553 (GCVE-0-2026-55553)
Vulnerability from cvelistv5 – Published: 2026-08-25 16:18 – Updated: 2026-08-25 18:25
VLAI
EPSS
VEX
Title
urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Summary
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 18:25 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/node-modules/urllib/security/a… | x_refsource_CONFIRM |
| https://github.com/node-modules/urllib/pull/812 | x_refsource_MISC |
| https://github.com/node-modules/urllib/pull/813 | x_refsource_MISC |
| https://github.com/node-modules/urllib/commit/7c8… | x_refsource_MISC |
| https://github.com/node-modules/urllib/commit/811… | x_refsource_MISC |
| https://github.com/node-modules/urllib/releases/t… | x_refsource_MISC |
| https://github.com/node-modules/urllib/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | urllib |
Affected:
>= 3.0.0, < 4.9.1
Affected: < 2.44.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55553",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T18:25:35.484065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T18:25:40.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "urllib",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 4.9.1"
},
{
"status": "affected",
"version": "\u003c 2.44.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T16:18:21.519Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"
},
{
"name": "https://github.com/node-modules/urllib/pull/812",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/pull/812"
},
{
"name": "https://github.com/node-modules/urllib/pull/813",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/pull/813"
},
{
"name": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16"
},
{
"name": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46"
},
{
"name": "https://github.com/node-modules/urllib/releases/tag/v2.44.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/releases/tag/v2.44.1"
},
{
"name": "https://github.com/node-modules/urllib/releases/tag/v4.9.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/urllib/releases/tag/v4.9.1"
}
],
"source": {
"advisory": "GHSA-hq3h-g68c-hp78",
"discovery": "UNKNOWN"
},
"title": "urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55553",
"datePublished": "2026-08-25T16:18:21.519Z",
"dateReserved": "2026-06-16T23:11:20.213Z",
"dateUpdated": "2026-08-25T18:25:40.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40931 (GCVE-0-2026-40931)
Vulnerability from cvelistv5 – Published: 2026-04-21 20:57 – Updated: 2026-04-22 13:52
VLAI
EPSS
VEX
Title
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Summary
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.
Severity
8.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-22 13:51 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/node-modules/compressing/secur… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | compressing |
Affected:
>=2.0.0, < 2.1.1
Affected: < 1.10.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40931",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-22T13:51:59.094969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-22T13:52:42.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compressing",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "\u003e=2.0.0, \u003c 2.1.1"
},
{
"status": "affected",
"version": "\u003c 1.10.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this \"Logical vs. Physical\" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T20:57:09.840Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5"
}
],
"source": {
"advisory": "GHSA-4c3q-x735-j3r5",
"discovery": "UNKNOWN"
},
"title": "Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-40931",
"datePublished": "2026-04-21T20:57:09.840Z",
"dateReserved": "2026-04-15T20:40:15.518Z",
"dateUpdated": "2026-04-22T13:52:42.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24884 (GCVE-0-2026-24884)
Vulnerability from cvelistv5 – Published: 2026-02-04 19:35 – Updated: 2026-02-05 14:32
VLAI
EPSS
VEX
Title
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
Summary
Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-05 14:23 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/node-modules/compressing/secur… | x_refsource_CONFIRM |
| https://github.com/node-modules/compressing/commi… | x_refsource_MISC |
| https://github.com/node-modules/compressing/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-modules | compressing |
Affected:
= 2.0.0
Affected: < 1.10.4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-05T14:23:12.467869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-05T14:32:51.788Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "compressing",
"vendor": "node-modules",
"versions": [
{
"status": "affected",
"version": "= 2.0.0"
},
{
"status": "affected",
"version": "\u003c 1.10.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor\u2019s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T19:35:56.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3"
},
{
"name": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c"
},
{
"name": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361"
}
],
"source": {
"advisory": "GHSA-cc8f-xg8v-72m3",
"discovery": "UNKNOWN"
},
"title": "Compressing Vulnerable to Arbitrary File Write via Symlink Extraction"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24884",
"datePublished": "2026-02-04T19:35:56.357Z",
"dateReserved": "2026-01-27T19:35:20.527Z",
"dateUpdated": "2026-02-05T14:32:51.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}