Skip to content
OpenAdvisories

Package · npm

decompress

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-39243

    decompress allows arbitrary hardlink creation during archive extraction

    decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() …

    decompress npm
  • Medium 6.4
    CVE-2026-10732

    decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

    All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a r…

    decompress npm