Executive brief
The compressing npm package is used to compress and decompress files in Node.js applications. A flaw in path validation allows attackers to bypass security checks and write files outside the intended extraction directory by pre-planting symbolic links in Git repositories. When a developer clones a malicious repository and extracts a tar file, the library fails to detect symlinks and follows them to arbitrary filesystem locations, potentially overwriting sensitive system files or application configurations.
Technical details
The vulnerability resides in the `isPathWithinParent()` utility function in `lib/utils.js`, which performs only string-based path validation using `path.resolve()`. This function checks if a resolved path starts with the destination directory string, but does not verify the actual filesystem state at extraction time. The core issue is a "logical vs. physical" divergence: while the library validates that a path string appears safe, the operating system kernel can follow pre-existing symbolic links during file write operations. An attacker can exploit this by committing a symbolic link to a Git repository (which Git preserves as a first-class object). When a victim clones the repository and the application extracts a tar archive, the library fails to detect symlinks in the path and allows writes to follow those links to arbitrary locations (e.g., `/etc/passwd`). The fix requires recursive `fs.lstatSync()` checks on each path segment before any write operation, similar to implementations in `node-tar`. Patched versions: 2.1.1 and 1.10.5.
Affected products
- node-modules compressing >=2.0.0, <=2.1.0; <=1.10.4
Timeline
- 2026-04-17: disclosed: Vulnerability disclosed in GHSA-4c3q-x735-j3r5
- 2026-04-13: advisory: GitHub advisory published for compressing v2.1.0
- 2026-04-17: patched: Patched versions released: 2.1.1 and 1.10.5