Skip to content
OpenAdvisories

Vendor

node-modules

3 known vulnerabilities.

Products

compressing 2 urllib 1
All Critical High Medium Low Exploited only

3 results · Feed

  • High 7.5
    CVE-2026-55553

    urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

    urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient…

    node-modules urllib urllib npm
  • High 8.4
    CVE-2026-40931

    Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

    Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with …

    node-modules compressing compressing npm
  • High 8.4
    CVE-2026-24884

    Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

    Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extr…

    node-modules compressing compressing npm