CVE-2026-101894
CriticalCVSS 9.1Summary
The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.
Risk Assessment
An attacker can achieve remote code execution on the server if the application uses a vulnerable version of the decompress package to extract untrusted archives. This can lead to full system compromise.
Recommendation
Update the @xhmikosr/decompress package to version 10.2.2 or 11.1.4 (or later). If using the unmaintained decompress package, consider migrating to the maintained fork.
Other vulnerabilities in decompress
See all- CVE-2026-53486Critical
A vulnerability in the decompress package for Node.js allows creating files and links outside the target directory during archive extraction. The issue stems from missing validation of hardlink and symlink paths, prefix-based path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes.
- CVE-2026-39246High
The 'decompress' library before version 4.2.2 allows arbitrary symlink creation during archive extraction. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory, leading to information disclosure.
- CVE-2026-39245Medium
In the 'decompress' library before version 4.2.2, a path traversal and arbitrary file write vulnerability exists due to improper path containment check. The safeMakeDir function and extraction path validation use String.indexOf() to verify the resolved path is within the output directory, which can be bypassed by missing a path separator boundary. An attacker can write arbitrary files outside the intended directory, bypassing the fix for CVE-2020-12265.
- CVE-2026-39243Medium
The 'decompress' library before version 4.2.2 allows arbitrary hardlink creation during archive extraction. An attacker can craft an archive with a hardlink entry containing an absolute path to any file on the same filesystem, leading to file content disclosure or overwriting.
- CVE-2026-10732Medium
The decompress package in all versions is vulnerable to arbitrary file write via archive extraction (Zip Slip). The vulnerability is due to microtask processing order that bypasses existing protections against writing through symlinks. An attacker can provide a crafted ZIP archive, potentially leading to remote code execution.
Original NVD description (English source)
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS