CVE-2026-24884: High-Severity npm compressing Flaw Allows Silent File Overwrite via Malicious Archives

CVE-2026-24884

CVE ID: CVE-2026-24884
Affected Component: compressing npm package (tar extraction functionality)
Affected Versions:

All versions ≤ 1.10.3
Version 2.0.0

Fixed Versions:

1.10.4
2.0.1 and later

CVSS v3.1 Score: 8.4
Severity: High
Attack Vector: Local (via crafted archive processed by an application)
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Exploitability: High when untrusted archives are processed
Exploit Availability: Proof-of-concept techniques are publicly known and reproducible for educational and defensive testing purposes

Official Patch / Upgrade Link (only authoritative reference):
https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c

Vulnerability Overview

A symlink traversal vulnerability was identified in the tar extraction logic of the compressing npm package. During archive extraction, symbolic links embedded inside a TAR archive were created without validating their final resolved destination. As a result, files extracted later in the same archive could be written outside of the intended extraction directory.

Because of this behavior, arbitrary file creation or overwrite became possible on the host system, limited only by the permissions of the process performing the extraction. The vulnerability existed due to insufficient validation of symbolic link targets before file write operations were completed.

Root Cause Analysis

The issue was caused by improper handling of symbolic links during TAR archive extraction. While path traversal sequences in file paths were partially handled, symbolic link targets were trusted as-is.

The following conditions contributed to the vulnerability:

Symbolic links inside archives were allowed to point to absolute paths (for example /tmp, /etc, or /var/www)
Subsequent archive entries were resolved through these symlinks
File writes were performed without verifying that the resolved path remained inside the intended extraction directory

This resulted in improper link resolution before file access.

Exploitation Scenario

The vulnerability could be exploited in environments where untrusted TAR or TGZ archives were automatically extracted. A typical exploitation flow is described below:

A malicious TAR archive is crafted containing:
- A symbolic link entry pointing to a sensitive or writable directory outside the extraction root
- One or more file entries placed under the symlink path
The vulnerable application extracts the archive using compressing.tar.uncompress
The symlink is created first inside the extraction directory
When subsequent files are extracted, the symlink is followed
Files are written to the symlink target location outside the extraction directory

If extraction is performed by a privileged process, sensitive system files may be overwritten. If performed by an application service account, application logic, scripts, or web-accessible files may be modified.

Impact

The following impacts are possible depending on context and privileges:

Arbitrary file overwrite
Unauthorized file creation
Application configuration manipulation
Persistence mechanisms via startup scripts or cron jobs
Potential code execution through overwritten scripts or binaries
Denial of service by corrupting required files

The vulnerability is particularly dangerous in CI/CD pipelines, build systems, container image builds, and backend services that automatically extract uploaded archives.

Proof of Concept (Educational)

At a high level, the PoC demonstrates:

A TAR archive containing a symlink entry such as linkDir → /tmp
A file entry such as linkDir/payload.txt
When extracted, /tmp/payload.txt is created instead of being confined to the extraction directory

This technique confirms that symbolic links are followed without restriction. No weaponized payload is required to demonstrate the issue.

MITRE Mapping

CWE-59: Improper Link Resolution Before File Access (Link Following)

Detection Strategy

Detection should focus on identifying unexpected file writes caused by archive extraction processes, particularly those involving Node.js or npm-based services.

Relevant Log Sources

Application logs (Node.js runtime logs)
Linux audit logs (auditd)
Container runtime logs (Docker, Kubernetes)
Endpoint Detection and Response (EDR) telemetry
File Integrity Monitoring (FIM) logs
CI/CD pipeline execution logs

Indicators of Suspicious Activity

File creation or overwrite outside expected extraction directories
Node.js processes writing to system paths such as /etc, /usr, /var, or /opt
Symlinks inside extraction directories pointing to absolute paths
File modification timestamps matching archive extraction times
Unexpected files appearing immediately after archive uploads or pipeline runs

Detection Queries

Auditd-Based Detection

Monitor file creation and write operations by Node.js processes in sensitive directories:

-a always,exit -F arch=b64 -S open,openat,creat -F exit=0 -F exe=/usr/bin/node -F dir=/etc -k node_sensitive_write
-a always,exit -F arch=b64 -S open,openat,creat -F exit=0 -F exe=/usr/bin/node -F dir=/usr/local/bin -k node_sensitive_write

Splunk Detection Query

Detect Node.js processes writing outside application directories shortly after archive handling:

index=os_logs OR index=audit_logs
| where process_name="node"
| search file_path IN ("/etc/*", "/usr/*", "/var/www/*", "/opt/*")
| stats count min(_time) max(_time) by host user process_name file_path
| where count > 0

EDR / Process Monitoring Logic

Alert when:

Process name equals node
Parent process relates to package extraction, build, or upload handling
File write occurs outside approved application directories
Event occurs within a short time window after archive processing

Remediation and Mitigation

Permanent Fix

The issue has been resolved upstream by adding validation to ensure that all resolved paths remain within the intended extraction directory and by skipping malicious archive entries.

Action Required:
Upgrade the compressing npm package to version 1.10.4 or 2.0.1 (or later).

Official Patch Link:
https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c

Temporary Mitigations (If Upgrade Is Delayed)

Extraction should be performed inside isolated containers or sandboxes
Archive extraction should not be executed with elevated privileges
Archives should be pre-scanned for symbolic links with absolute or external targets
File system permissions should be restricted to prevent writes to sensitive locations

Final Takeaway

This vulnerability represents a high-risk file system integrity issue when untrusted archives are processed. While exploitation requires archive delivery, such conditions are common in modern development pipelines and backend services. Immediate patching and log-based detection are strongly recommended.