CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

EUVD-2026-95103

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3 . The issue is located in lib/decompress-zip.js, where the software improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive with entries resolving to prefix-sibling directories can ca...

ROOT-APP-NPM-CVE-2026-101894 CVE-2026-101894 in decompress - Patched by Root

Root has patched CVE-2026-101894 in the decompress package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-130799 AIKIDO-2026-130799 in @xhmikosr/decompress - Patched by Root

Root has patched AIKIDO-2026-130799 in the @xhmikosr/decompress package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53486 CVE-2026-53486 in @xhmikosr/decompress - Patched by Root

Root has patched CVE-2026-53486 in the @xhmikosr/decompress package for Root:npm. Multiple fixed versions available...

pocs

Proof of Concept Collection Consolidated repository of proof-...

CLEANSTART-2026-LB53139 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

CVE-2026-84890 affects multiple packages. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. See references for individual vulnerability details...

ROOT-APP-NPM-CVE-2020-12265 CVE-2020-12265 in decompress - Patched by Root

Root has patched CVE-2020-12265 in the decompress package for Root:npm. Multiple fixed versions available...

CLSA-2026-1791225543 TuxCare security update for decompress (2 CVEs)

TuxCare rebuilt decompress to address 2 CVEs. Fixed in 4.2.1-tuxcare.1...

Astra Linux – Vulnerability in ntfs-3g

A properly crafted NTFS image can lead to a out-of-bounds access vulnerability in the ntfsdecompress function in NTFS-3G, version 2021.8.22...

CVE-2026-101894

CVE-2026-101894 — @xhmikosr/decompress シンボリックリンクチェーンによるパストラバーサル CVE-2026-101894 の Python 3 PoC — @xhmikosr/decompress （およびメンテナンスされていない decompress ）における Node.js のアーカイブ展開は、シンボリックリンクエントリの連鎖 を介して 出力ディレクトリ外への読み取り/書き込み を可能にします。CVE-2026-53486 のハードニングのバイパスです。CVSS 3.1 9.1 Critical 。 | ---|--- PoCbit|...

Inefficient Algorithmic Complexity

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the decompress function in pypdf/filters.py when processing a /FlateDecode stream. The...

CLEANSTART-2026-PN21117 BZ2_decompress in decompress

Security vulnerability affects the bzip2 package. BZ2decompress in decompress...

PT-2026-103282

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...

@xhmikosr/decompress: Path traversal via symlink chain

Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...

NPM: @xhmikosr/decompress: Path traversal via symlink chain

NPM: @xhmikosr/decompress: Path traversal via symlink chain vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

@buddy-works/storybook (1.0.0), @martincik/fast-text-language-detection (>=0.2.4, <=0.2.8) +14 more potentially affected by CVE-2026-101894 via @xhmikosr/decompress (>=11.1.1, <=11.1.3)

@xhmikosr/decompress NPM version =11.1.1, =0.2.4, =0.0.1, =1.0.1, =1.18.27-dev, =1.0.3, =0.9.1, =0.0.1, =0.129.1, =0.132.1 and more Source cves: CVE-2026-101894 Source advisory: OSV:GHSA-HRH2-VP3X-79XF...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-101894 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-101894 Source advisory: OSV:GHSA-HRH2-VP3X-79XF...