CVE-2026-39245: Directory Traversal in decompress Package – Upgrade to 4.2.2

Technical summary

CVE-2026-39245 is a directory traversal vulnerability in the decompress package caused by improper path containment validation. The safeMakeDir function and extraction path validation at index.js lines 29 and 106 rely on String.indexOf() to confirm that resolved paths remain within the output directory. The vulnerable check—realDestinationDir.indexOf(realOutputPath) !== 0—lacks path separator enforcement, creating a semantic bypass. A path like '/tmp/app_config' returns 0 when indexOf('/tmp/app') is called, passing validation despite residing outside '/tmp/app'. This flaw is compounded by unvalidated symlink creation within the package. The vulnerability represents a bypass of the earlier CVE-2020-12265 mitigation. The correct implementation requires appending path.sep: realParentPath.indexOf(realOutputPath + path.sep) !== 0, ensuring boundary-aware validation.

Business impact

Successful exploitation enables arbitrary file writes to the filesystem, with scope limited to the local system where the application runs. In typical deployment scenarios, this could allow an attacker who controls archive contents to overwrite application configuration files, inject malicious code into adjacent directories, or corrupt critical data. For applications processing untrusted archives (e.g., user uploads, third-party integrations), this creates a direct path to code execution or privilege escalation if the application runs with elevated permissions. Organizations relying on decompress for archive handling should assume that previously-validated archive files may now pose a risk if processed with vulnerable versions.

Affected systems

The decompress package versions prior to 4.2.2 are affected. Any application or service that includes decompress as a dependency and processes compressed archives is vulnerable. This includes Node.js applications that extract user-supplied or untrusted archives. Verify your dependency tree and lockfile (package-lock.json, yarn.lock, or pnpm-lock.yaml) to identify if decompress is a direct or transitive dependency, and confirm the installed version. Check vendor documentation or GitHub releases to confirm version 4.2.2 availability and compatibility with your application.

Exploitability

Exploitation requires local access and the ability to influence archive content that the application will decompress. The attack vector is local with low complexity: no special privileges, user interaction, or network access are needed—only control over a compressed file that the target application will extract. The main constraint is that the attacker must either directly provide the archive or compromise a repository from which the application fetches it. Given that many applications process archives from multiple sources (file uploads, API responses, CI/CD pipelines), the exploitability is moderate to high in real-world scenarios, though the CVSS score reflects the local-only attack surface.

Remediation

Upgrade decompress to version 4.2.2 or later, which corrects the path validation logic to enforce path separator boundaries. Review your application's dependency management and ensure the update is reflected in your lockfile. For applications that cannot immediately upgrade, implement additional validation of extracted file paths in application code as a compensating control, though this should not replace the package-level fix. Test the upgrade in a non-production environment first to confirm compatibility with your application version.

Patch guidance

Update decompress to version 4.2.2 or higher. If you use npm: run 'npm update decompress' or specify the minimum version in package.json and reinstall. If you use Yarn: run 'yarn upgrade decompress' to ^4.2.2. If you use pnpm: run 'pnpm update decompress'. After updating, regenerate your lockfile, run your test suite, and confirm that archive extraction behaves correctly. Verify against the official decompress GitHub repository or npm package page to confirm the exact version number and release date before deploying.

Detection guidance

Monitor for attempts to extract archives where output paths contain suspicious parent-directory traversal sequences (../, etc.), though note that this vulnerability does not require explicit traversal syntax—the flaw is in validation logic itself. Log all archive extraction operations, including source file, destination directory, and extracted file paths. Implement file integrity monitoring on configuration directories and other sensitive paths adjacent to typical extraction targets. Identify applications using decompress by scanning dependencies; tools like 'npm audit', 'snyk test', or 'trivy' can flag vulnerable versions in your supply chain. Look for recent archive processing by the affected application and correlate with any unexpected file modifications in sibling directories.

Why prioritize this

Although the CVSS score is medium (6.2) due to local-only attack surface, prioritize based on context: if your application processes archives from untrusted sources or runs with elevated privileges, treat this as higher priority. The vulnerability is a bypass of a prior fix, indicating the attack surface remains attractive to adversaries. Organizations with strict security postures should patch immediately; those with air-gapped or low-risk archive workflows may defer slightly, but should not delay indefinitely.

Risk score, explained

The CVSS 3.1 score of 6.2 (MEDIUM) reflects a local attack vector with no privilege requirements or user interaction needed, but no confidentiality impact and limited scope. The integrity impact is marked HIGH because arbitrary file writes are possible. The score assumes local-only access; if your threat model includes remote archive ingestion (e.g., via API or user upload), the practical risk is higher than the score suggests.

Frequently asked questions