---
id: CVE-2026-39243
title: >-
  decompress before 4.2.2 allows arbitrary hardlink creation during archive
  extraction, enabling file read disclosure and file corruption
summary: >-
  decompress before 4.2.2 allows arbitrary hardlink creation during archive
  extraction, enabling file read disclosure and file corruption. When processing
  hardlink entries (type === 'link'), the x.linkname field from the archive is
  passed …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-59
vendor: decompress_project
product: decompress
affected:
  - decompress <= 4.2.1
published: '2026-07-09'
updated: '2026-07-13'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39243'
references:
  - url: 'https://github.com/kevva/decompress'
    label: cve@mitre.org
  - url: 'https://github.com/kevva/decompress/issues/113'
    label: cve@mitre.org
  - url: 'https://www.npmjs.com/package/decompress'
    label: cve@mitre.org
  - url: 'https://github.com/kevva/decompress/issues/113'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00301
epssPercentile: 0.23061
ingestedAt: '2026-07-13T13:27:18.438Z'
---

## Overview

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.

## Affected

- `decompress <= 4.2.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.