@buddy-works/storybook (1.0.0), @martincik/fast-text-language-detection (>=0.2.4, <=0.2.8) +14 more potentially affected by CVE-2026-101894 via @xhmikosr/decompress (>=11.1.1, <=11.1.3)

@xhmikosr/decompress NPM version =11.1.1, =0.2.4, =0.0.1, =1.0.1, =1.18.27-dev, =1.0.3, =0.9.1, =0.0.1, =0.129.1, =0.132.1 and more Source cves: CVE-2026-101894 Source advisory: OSV:GHSA-HRH2-VP3X-79XF...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-101894 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-101894 Source advisory: OSV:GHSA-HRH2-VP3X-79XF...

SUSE CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

Exploit for CVE-2026-101894

CVE-2026-101894 — @xhmikosr/decompress symlink-chain path trav...

CLEANSTART-2026-CL40927 undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header

Security vulnerability affects the langfuse package. undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-101894 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-101894 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-20254...

@buddy-works/storybook (1.0.0), @martincik/fast-text-language-detection (>=0.2.4, <=0.2.8) +14 more potentially affected by CVE-2026-101894 via @xhmikosr/decompress (>=11.1.1, <=11.1.3)

@xhmikosr/decompress NPM version =11.1.1, =0.2.4, =0.0.1, =1.0.1, =1.18.27-dev, =1.0.3, =0.9.1, =0.0.1, =0.129.1, =0.132.1 and more Source cves: CVE-2026-101894 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-20254118...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28599 more potentially affected by CVE-2026-101894 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-101894 Source advisory: SNYK:JS-DECOMPRESS-20254116...

Directory Traversal

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. ...

Directory Traversal

Overview @xhmikosr/decompress is an Extracting archives made easy Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. An attack...

CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

EUVD-2026-88365

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894

The decompress package for Node.js is vulnerable to a path traversal flaw due to inadequate lexical containment checks. An attacker can provide a crafted archive with chained symlink entries to bypass directory restrictions, allowing them to read or write files outside the intended output directo...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894: Improper Limitation of a Pathname to a Restricted Directory

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

PT-2026-99937

Name of the Vulnerable Software and Affected Versions @xhmikosr/decompress versions prior to 10.2.2 @xhmikosr/decompress versions prior to 11.1.4 decompress versions prior to 4.2.2 Description The default decompressinput, output API uses lexical containment checks that fail to account for the...

PT-2026-98820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp async component where the process input packet function incorrectly resets a reused socket buffer skb headroom to zero during a frame-error path. This violates...

CVE-2026-57226

A flaw was found in Suricata, a network Intrusion Detection System IDS. When the non-default SWF Small Web Format decompression feature is enabled with an unsafe decompression depth, a remote attacker can send a specially crafted SWF response. This can trigger a heap buffer overflow during HTTP S...