CVE-2020-12265

The CVE-2020-12265 entry concerns the Node.js decompress package before version 4.2.1. Root cause: Directory Traversal via ../ in an archive member when a symlink is used, allowing Arbitrary File Write. Affected software: decompress (Node.js) prior to 4.2.1. Impact statements in the connected doc...

CVE-2026-39245

The decompress component (versions before 4.2.2) contains an improper path containment check that enables directory traversal and arbitrary file write . The root cause lies in the safeMakeDir function (index.js line 29) and extraction path validation (index.js line 106), which use String.indexOf(...

CVE-2026-39243

Versions of decompress prior to 4.2.2 are vulnerable to arbitrary hardlink creation during archive extraction. The root cause is a lack of validation on the x.linkname field (at index.js line 113), which is passed directly to fs.link(). An attacker can craft a malicious archive with an absolute p...

CVE-2026-39246

The decompress package for Node.js (versions prior to 4.2.2 ) is vulnerable to a symlink attack during archive extraction. The root cause is a lack of validation on the x.linkname field; while some checks exist for file entries, they do not apply to symlink creation (specifically at index.js line...