decompress vulnerabilities

2 known vulnerabilities in decompress from XhmikosR. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  decompress: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-101894Sep 28, 2026XhmikosR

  The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a craf

• 9.1 Critical severity

  decompress: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-53486Jul 14, 2026XhmikosR

  The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that dire