# @xhmikosr/decompress (npm) vulnerabilities 2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.1.4 (Aug 5, 2026): no advisory affects it - Newest unaffected release: 11.1.4 (Aug 5, 2026), the latest release - Weekly downloads: 8.4M - Dependents: 49 - Releases: 20 since 5.0.0 (Mar 15, 2023) - Registry: https://www.npmjs.com/package/@xhmikosr/decompress - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-101894: 5.0.0 to 10.2.1 (10.2.2 is outside it); 11.0.0 to 11.1.3 (11.1.4 is outside it) - CVE-2026-53486: 5.0.0 to 10.2.0 (10.2.1 is outside it); 11.0.0 to 11.1.2 (11.1.3 is outside it) ## Advisories (2) ### [CVE-2026-101894](https://cve.now/CVE-2026-101894): @xhmikosr/decompress: Path traversal via symlink chain - Severity: Critical 9.1 - Published: Sep 28, 2026 - Affected: from 11.0.0, fixed in 11.1.4; fixed in 10.2.2. - Fixed in 10.2.2 (released Aug 5, 2026, 54 days before disclosure) and 11.1.4 (released Aug 5, 2026, 54 days before disclosure). - The latest release, 11.1.4, is not affected. - 39% of @xhmikosr/decompress downloads last week were affected versions (3.6M). ### [CVE-2026-53486](https://cve.now/CVE-2026-53486): decompress: Archive extraction can create files and links outside the target directory - Severity: Critical 9.1 - Published: Jul 14, 2026 - Affected: fixed in 10.2.1; from 11.0.0, fixed in 11.1.3. - Fixed in 10.2.1 (released May 30, 2026, 45 days before disclosure) and 11.1.3 (released May 30, 2026, 45 days before disclosure). - The latest release, 11.1.4, is not affected. - 27% of @xhmikosr/decompress downloads last week were affected versions (2.5M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@xhmikosr/decompress Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.