CVE-2026-39243 — decompress
MEDIUMCVE-2026-39243 is a medium-severity (CVSS 5.5) CWE-59 vulnerability in decompress. No vendor fix is recorded yet; mitigation options are listed below.
decompress allows arbitrary hardlink creation during archive extraction
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-39243.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-39243 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 384,189 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
decompressnpmDescription
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | decompress | all versions | No fix |
Affected Products
decompressdecompress_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for decompress, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of decompress has shipped for CVE-2026-39243 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This Moderate flaw in the `decompress` library allows an attacker to create arbitrary hardlinks during archive extraction. By crafting a malicious archive, an attacker could exploit this to disclose sensitive file contents or corrupt files on the same filesystem where the archive is extracted. This risk is present in…
To mitigate this issue, avoid extracting archives from untrusted or unknown sources. When processing archives from potentially untrusted origins, consider using a sandboxed environment to limit the impact of any malicious content.Source: Red Hat security advisory for CVE-2026-39243 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Hardened Images | dotnet8-0-main-8.0.128-1.1.hum1 | RHSA-2026:37577 |
Frequently Asked Questions
Is CVE-2026-39243 in your dependencies?
Find it across npm, including transitive dependencies.