CVE-2026-39243: decompress Arbitrary Hardlink Creation Vulnerability

Technical summary

The vulnerability stems from insufficient validation of the linkname field in hardlink archive entries. During extraction, the decompress library processes hardlink entries (identified by type === 'link') and passes the x.linkname value directly to fs.link() without checking whether the target path is within the intended extraction directory. An attacker can specify an absolute path in the linkname field, causing fs.link() to create a hardlink from inside the extraction directory to an arbitrary file on the same filesystem. Because hardlinks share inodes, subsequent operations on the hardlink provide read and write access to the original file. The impact is limited to files on the same filesystem and cannot be used against directories due to hardlink constraints.

Business impact

Organizations using decompress to handle untrusted archives face confidentiality and integrity risks. Attackers can exfiltrate sensitive files (configuration files, credentials, application data) or corrupt system or application files by crafting malicious archives. The risk is highest in automated workflows that extract user-supplied archives, such as file upload features, package managers, or CI/CD pipelines. Compromised file integrity could lead to supply chain attacks or lateral privilege escalation if writable system files are targeted.

Affected systems

The vulnerability affects decompress versions prior to 4.2.2. Any system or application using an affected version to extract archives—particularly those handling archives from untrusted sources—is at risk. This includes development tools, build systems, package managers, and file-sharing or upload platforms that rely on decompress for archive handling.

Exploitability

Exploitation requires crafting a malicious archive file and convincing or tricking a user to extract it using vulnerable decompress code. No network interaction or authentication is required. The attack surface is broad for any application that accepts user-uploaded archives. However, the hardlink attack is limited by filesystem boundaries (attacker can only target files on the same filesystem as the extraction directory) and cannot target directories. The requirement for user action (initiating extraction) provides a modest barrier but is easily overcome in automated or negligent extraction scenarios.

Remediation

Upgrade decompress to version 4.2.2 or later immediately. Verify the update in your dependency lock files and rebuild affected applications. If immediate upgrading is not feasible, restrict untrusted archive extraction to isolated environments or sandboxes, and limit file permissions on the extraction directory to prevent hardlink access to sensitive system files. Review logs to identify whether malicious archives have been processed in recent weeks.

Patch guidance

Apply the update to decompress 4.2.2 or newer via your package manager (npm update decompress, or equivalent for your build tooling). Confirm the version change in package-lock.json or yarn.lock. Redeploy affected applications and services. Verify that no archived hardlink entries were created during the vulnerability window by checking filesystem inodes for unexpected cross-directory links in historically used extraction directories.

Detection guidance

Monitor extraction logs for unusual hardlink creation patterns, particularly hardlinks that reference files outside the intended extraction directory. File integrity monitoring tools can alert on unexpected inode sharing between sensitive files and temporary extraction directories. Review deployed versions of decompress in your software bill of materials (SBOM) to identify affected systems. Check for suspicious archive uploads or processing in the days before the patch is applied; correlate with any subsequent file modification or access anomalies.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), the vulnerability should be prioritized for rapid patching because it affects a widely-used library and enables direct read access to arbitrary files with minimal barrier to exploitation. Organizations handling user-supplied archives should treat this as high-priority. The vulnerability does not require network access or authentication, making it a practical attack vector in file upload and package handling scenarios. Delayed patching exposes organizations to data exfiltration and integrity attacks.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and high confidentiality impact (C:H) with no integrity or availability impact. The user interaction requirement (extraction action) and local-only scope prevent a higher severity rating. However, the high confidentiality impact and ease of exploitation in real-world file-handling workflows warrant urgent attention despite the MEDIUM classification.

Frequently asked questions