CVE-2026-39243

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.2

Description An issue exists during archive extraction where arbitrary hardlink creation is possible. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to the fs.link() function without validation. An attacker can craft an archive containing a hardlink entry with an absolute path to any file on the same filesystem. This creates a hardlink within the extraction directory that shares the same inode (a unique identifier for a file on a filesystem) as the target file, allowing the original file's content to be read or overwritten. Hardlinks are restricted to files on the same filesystem and cannot target directories.

Recommendations Update decompress to version 4.2.2 or later.