# decompress (npm) vulnerabilities

5 known vulnerabilities (2 critical, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 4.2.1 (Apr 1, 2020): affected by 4 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Weekly downloads: 3.8M
- Dependents: 26.7K
- Releases: 41 since 0.1.0 (Aug 23, 2013)
- Registry: https://www.npmjs.com/package/decompress
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-101894: 0.1.0 to 4.2.1 (through the newest release)
- CVE-2026-53486: 0.1.0 to 4.2.1 (through the newest release)
- CVE-2026-39243: 0.1.0 to 4.2.1 (through the newest release)
- CVE-2026-10732: 0.1.0 to 4.2.1 (through the newest release)
- CVE-2020-12265: 0.1.0 to 4.2.0 (4.2.1 is outside it)

## Advisories (5)

### [CVE-2026-101894](https://cve.now/CVE-2026-101894): @xhmikosr/decompress: Path traversal via symlink chain

- Severity: Critical 9.1
- Published: Sep 28, 2026
- Affected: through 4.2.1.
- No fix released. The latest release, 4.2.1, is still affected.
- 100% of decompress downloads last week were affected versions (4.6M).

### [CVE-2026-53486](https://cve.now/CVE-2026-53486): decompress: Archive extraction can create files and links outside the target directory

- Severity: Critical 9.1
- Published: Jul 14, 2026
- Affected: through 4.2.1.
- No fix released. The latest release, 4.2.1, is still affected.
- 100% of decompress downloads last week were affected versions (4.6M).

### [CVE-2026-39243](https://cve.now/CVE-2026-39243): decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.

- Severity: Medium 5.5
- Published: Jul 9, 2026
- Affected: through 4.2.1.
- No fix released. The latest release, 4.2.1, is still affected.
- 100% of decompress downloads last week were affected versions (4.6M).

### [CVE-2026-10732](https://cve.now/CVE-2026-10732): All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP…

- Severity: Medium 6.1
- Published: Jun 5, 2026
- Affected: through 4.2.1.
- No fix released. The latest release, 4.2.1, is still affected.
- 100% of decompress downloads last week were affected versions (4.6M).

### [CVE-2020-12265](https://cve.now/CVE-2020-12265): The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is…

- Severity: Unrated
- Published: Apr 26, 2020
- Affected: fixed in 4.2.1.
- Fixed in 4.2.1 (released Apr 1, 2020, 25 days before disclosure).
- The latest release, 4.2.1, is not affected.
- 4.7% of decompress downloads last week were affected versions (219.2K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/decompress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.