Which versions of zip-lib are affected by EUVD-2026-49687?

A path-validation defect in the zip-lib npm package (versions prior to 1.1.0) lets a specially crafted ZIP archive write files outside the folder an application intended to extract into, allowing…. A patch is available.

How to fix or mitigate EUVD-2026-49687?

Within 24 hours, inventory every application, service, container image, and CI/CD job that depends on zip-lib (for example via 'npm ls zip-lib', lockfile review, or an SCA/SBOM scan) and flag any resolved version below 1.1.0; prioritize those that extract archives from untrusted or external sources. Within 7 days, upgrade all affected consumers to zip-lib 1.1.0 or later, refresh lockfiles, rebuild and redeploy the affected artifacts, and confirm no transitive pin still resolves to a pre-1.1.0 release. Within 30 days, verify the fix is present in production and re-scan to confirm the finding is closed, add a regression test covering symlink-based archive extraction (mirroring the vendor's unzipArbitraryFileWrite test), and tighten dependency governance so libraries handling archive extraction are tracked and patched under a defined SLA. If any consumer cannot be upgraded immediately, restrict its extraction target to an ephemeral, least-privilege directory and run the process as a non-privileged account until the upgrade lands.

zip-lib EUVD-2026-49687

Q: What is the CVSS score of EUVD-2026-49687?

EUVD-2026-49687 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-17524 HIGH

Path Traversal (CWE-22)

2026-07-28 snyk

GHSA-73hr-7685-xwj3

Path Traversal Node.js Zip Lib

8.7

CVSS 4.0 · Vendor: snyk

Severity by source

Vendor (snyk) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Malicious archive is network-delivered and needs no privileges (AV:N/PR:N); impact is arbitrary file write outside the target folder (I:H), with no confidentiality or availability effect, so C:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 16, 2026 - 09:40 vuln.today

tag: Node.js added

Source Code Evidence Fetched

Jul 28, 2026 - 08:06 vuln.today

Analysis Generated

Jul 28, 2026 - 08:06 vuln.today

Patch available

Jul 28, 2026 - 07:01 EUVD

CVSS changed

Jul 28, 2026 - 06:22 NVD

7.5 (HIGH) 8.7 (HIGH)

CVE Published

Jul 28, 2026 - 05:00 cve.org

HIGH 8.7

DescriptionCVE.org

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction.

AnalysisAI

Directory traversal during archive extraction in zip-lib (npm) before 1.1.0 lets an attacker-crafted zip archive write files outside the intended destination folder. The root cause is the library's cached path validation: isOutsideTargetFolder only evaluates and caches a path's status when the first directory symlink is created during extraction, so subsequent archive entries that resolve through that symlink bypass the "outside target folder" check (CWE-22). The realistic impact is arbitrary file write / integrity loss rather than data disclosure, consistent with the fix commit that adds a symlinkFolders tracking list and a regression test named unzipArbitraryFileWrite. Exploitation requires the consuming application to extract an attacker-supplied archive with an affected version; there is no authentication or user-interaction gate beyond the extraction itself (PR:N/UI:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.78% (52nd percentile), and the vendor fix is publicly available in 1.1.0.

Technical ContextAI

zip-lib is an open-source Node.js/TypeScript archive (zip/unzip) library published to npm under the fpsqdb repository, widely used by build tools, server-side upload handlers and automation that extract user-provided archives. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal), specifically a symlink-based escape during extraction. In pre-1.1.0 code, ensureFolder/mkdir in src/fs.ts used fs.stat and treated an existing entry as a normal directory, while unzip.ts maintained a validation helper (isOutsideTargetFolder) that short-circuits as soon as it has cached a result for a path. Because the symlink directory is created by the first archive entry and the check for it is cached, entries extracted later (for example 'dirlink/../../evil.js' or files placed under a symlinked directory) are resolved through the symlink without re-validation, allowing writes outside the target folder. The upstream fix changes src/unzip.ts to track symlink folders ('symlinkFolders: {folder, realpath}[]'), to run the outside-target check when either symlink files or symlink folders exist, and to compare each entry's realpath prefix against realTargetFolder; src/fs.ts now uses fs.lstat and realpath to distinguish real directories from symlinks and returns the resolved real path. The commit diff also comments out earlier ad-hoc debugging paths and adds test/src/unzipArbitraryFileWrite.ts as an explicit regression test. The CPE string cpe:2.3:a:n/a:zip-lib:*:*:*:*:*:*:*:* has an unassigned vendor component and no version bound, so the authoritative version constraint comes from the vendor/EUVD data: all releases below 1.1.0.

RemediationAI

Vendor-released patch: zip-lib 1.1.0 - upgrade to 1.1.0 or later (npm install zip-lib@^1.1.0) and rebuild any bundled/transpiled copies of the library, since the fix lives in src/unzip.ts and src/fs.ts and is delivered by the upstream commit https://github.com/fpsqdb/zip-lib/commit/0c29b1e17050f2611f4f37e6aaa92a60b3cb89d5; consult the Snyk advisory at https://security.snyk.io/vuln/SNYK-JS-ZIPLIB-13834403 and the upstream issue https://github.com/fpsqdb/zip-lib/issues/14 for tracking. Until every dependency is upgraded, apply the following compensating controls where untrusted archives are extracted: pre-screen archive entries and reject any that are symlinks, that contain '..' path segments, or that resolve outside the destination prefix (trade-off: legitimate archives that rely on symlinks or unusual relative paths may be rejected, and this requires custom parsing before extraction); extract into a dedicated, disposable directory owned by a least-privileged, non-privileged user or confined container so that any escape writes remain inside a disposable sandbox (trade-off: it does not stop overwriting files within that sandbox and needs correct volume/mount isolation); canonicalize each entry's destination with realpath against the destination root and abort the whole operation if a mismatch is detected after the first pass (trade-off: some overhead and it must be applied per-extraction, plus a partial write may have already occurred before abort, so combine it with ordering or symlink rejection); and avoid extracting attacker-controlled archives in the same filesystem subtree as application code, configs, cron/startup locations or package directories, since those are the practical targets of an arbitrary-file-write primitive. Note that EPSS is only 0.78% and there is no identified public exploit code, so prioritization can reflect the exposure of any extraction endpoint rather than mass emergency patching.