CVE-2026-39246

The decompress package for Node.js (versions prior to 4.2.2 ) is vulnerable to a symlink attack during archive extraction. The root cause is a lack of validation on the x.linkname field; while some checks exist for file entries, they do not apply to symlink creation (specifically at index.js line...