decompress vulnerabilities
CVEs whose affected-version data names the decompress package (npm, rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-101894Critical· 9.1PoC⚖ disputedThe decompress package for Node.js extracts archives
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An att…
RUSTSEC-2026-0328High· 7.1`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
CVE-2026-39246High· 7.5decompress before 4.2.2 allows arbitrary symlink creation during archive extraction
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index…
CVE-2026-39245Medium· 6.2decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.…
CVE-2026-39243Medium· 5.5decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed …
CVE-2026-53486Critical· 9.1Decompress: Archive extraction can create files and links outside of the target directory
Decompress: Archive extraction can create files and links outside of the target directory