CVE-2026-39243
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The 'decompress' library before version 4.2.2 allows arbitrary hardlink creation during archive extraction. An attacker can craft an archive with a hardlink entry containing an absolute path to any file on the same filesystem, leading to file content disclosure or overwriting.
Risk Assessment
The organization is at risk of sensitive data leakage and file corruption if a user extracts a malicious archive using the vulnerable library version. An attacker can read or overwrite any file on the filesystem accessible by the extraction process.
Recommendation
Immediately update the 'decompress' library to version 4.2.2 or later. If an update is not possible, avoid extracting archives from untrusted sources.
Other vulnerabilities in decompress
See all- CVE-2026-53486Critical
A vulnerability in the decompress package for Node.js allows creating files and links outside the target directory during archive extraction. The issue stems from missing validation of hardlink and symlink paths, prefix-based path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes.
- CVE-2026-39246High
The 'decompress' library before version 4.2.2 allows arbitrary symlink creation during archive extraction. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory, leading to information disclosure.
- CVE-2026-39245Medium
In the 'decompress' library before version 4.2.2, a path traversal and arbitrary file write vulnerability exists due to improper path containment check. The safeMakeDir function and extraction path validation use String.indexOf() to verify the resolved path is within the output directory, which can be bypassed by missing a path separator boundary. An attacker can write arbitrary files outside the intended directory, bypassing the fix for CVE-2020-12265.
- CVE-2026-10732Medium
The decompress package in all versions is vulnerable to arbitrary file write via archive extraction (Zip Slip). The vulnerability is due to microtask processing order that bypasses existing protections against writing through symlinks. An attacker can provide a crafted ZIP archive, potentially leading to remote code execution.
Original NVD description (English source)
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.