Critical
@xhmikosr/decompress: Path traversal via symlink chain
Type: advisorySource: Official CVE List
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted s…
Products: decompress, decompressCVEs: CVE-2026-101894