critical vulnerability

@xhmikosr/decompress: Path traversal via symlink chain

Partly patchedCritical · CVSS 9.1EPSS 0.81%

Published Sep 29, 2026 · updated Sep 29, 2026

What to do

Upgrade to a fixed version: @xhmikosr/decompress 11.1.4, @xhmikosr/decompress 10.2.2.
Some affected packages have no fixed version yet: follow the advisory for mitigations and watch this page for the fix.
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npm@xhmikosr/decompress3,190,336 downloads/week

Vulnerable versions: >= 11.0.0, <= 11.1.3
Fixed in: 11.1.4

Check your project: npm ls @xhmikosr/decompress --all

Is @xhmikosr/decompress@11.1.4 safe to install? See the upgrade verdict →

npm@xhmikosr/decompress3,190,336 downloads/week

Vulnerable versions: <= 10.2.1
Fixed in: 10.2.2

Check your project: npm ls @xhmikosr/decompress --all

Is @xhmikosr/decompress@10.2.2 safe to install? See the upgrade verdict →

npmdecompress1,764,898 downloads/week

Vulnerable versions: <= 4.2.1
Fixed in: no fix yet

Check your project: npm ls decompress --all

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · CWE-59 Improper Link Resolution Before File Access ('Link Following')

← All critical vulnerabilities