CVE-2026-87794 nfriedly CVE debrief

Who should care

Node.js developers and administrators using bestzip versions 2.2.6 or 3.0.2 should assess exposure and prioritize remediation. The vulnerability allows attackers to execute arbitrary commands, potentially leading to compromise and disruption of Node.js-based services. Affected systems should be verified and updated to versions 2.2.7 or 3.0.3. Security teams and vulnerability management teams should review and implement compensating controls for exposed to

Why it matters

CVE-2026-87794 bestzip argument injection vulnerability requires immediate attention from Node.js developers and administrators. The vulnerability allows attackers to execute arbitrary commands, potentially leading to compromise and disruption of Node.js-based services. Remediation priority is high, and affected systems should be verified and updated to versions 2.2.7 or 3.0.3.

• Potential for arbitrary command execution with Node.js process privileges
• Possible lateral movement and compromise of sensitive data
• Need for urgent remediation and verification of affected systems
• Potential disruption to Node.js-based services and applications

Technical summary

The bestzip library versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function. This allows attackers to inject arbitrary arguments to the Info-ZIP backend, potentially leading to arbitrary command execution with Node.js process privileges. The vulnerability is caused by inadequate input validation and can be exploited by supplying a malicious destination path combined with crafted source entries. The vulnerability has been fixed in versions 2.2.7 and 3.0.3. Node.js developers and administrators should assess exposure and prioritize remediation.

Defensive priority

High priority for Node.js deployments using bestzip versions 2.2.6 or 3.0.2

Recommended defensive actions

• Upgrade to bestzip version 2.2.7 or 3.0.3
• Review and restrict usage of the nativeZip function
• Monitor Node.js deployments for suspicious activity
• Perform vulnerability scanning and asset inventory of Node.js deployments using bestzip
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the argument injection vulnerability in bestzip. Vendor information is limited, with the vendor name listed as 'Unknown Vendor'. The vulnerability allows attackers to execute arbitrary commands, potentially leading to compromise and disruption of Node.js-based services. Remediation priority is high, and affected systems should be verified and updated to versions 2.2.7 or 3.0.3. The Info-ZIP backend is used by bestzip, and the vulnerability is caused by inadequate input validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.