Decompress Project Decompress
4 CVEs affecting Decompress Project Decompress. Latest disclosed: 2026-07-09. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-12265 | Critical | 9.8 | 2020-04-26 | The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Director… |
CVE-2026-39246 | High | 7.5 | 2026-07-09 | decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field… |
CVE-2026-39245 | Medium | 6.2 | 2026-07-09 | decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index… |
CVE-2026-39243 | Medium | 5.5 | 2026-07-09 | decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardli… |