A critical directory traversal vulnerability in the Compressing library for Node.js allows for unauthorized file system access due to flawed path validation logic.

This vulnerability, categorized as CWE-59, stems from a logical failure in the isPathWithinParent utility, which fails to account for the actual filesystem state when validating paths. An unauthenticated attacker can exploit this divergence using directory poisoning with symbolic links to escape intended directory boundaries.

Successful exploitation of this flaw can lead to unauthorized access, modification, or destruction of sensitive files on the host system. Given the CVSS score of 8.4, this vulnerability represents a high risk to data integrity and system confidentiality. Organizations relying on this library for file archival or extraction processes are at significant risk of compromise.

Immediate Action: Update the npm compressing package to version 2.1.1 or 1.10.5 immediately to incorporate the corrected path validation logic.

Proactive Monitoring: Review application logs for unusual file access patterns or attempts to access files outside of designated base directories.

Compensating Controls: Ensure that the Node.js process runs with the principle of least privilege, restricting its filesystem access to only the directories absolutely necessary for its operation.

Public Exploit Available: Unknown.

Due to the severity of the potential impact and the availability of a patch, all development teams using the node-modules compressing library must prioritize updating to the fixed versions. Failure to apply these updates leaves systems vulnerable to directory traversal attacks that could compromise the entire host environment.