CVE-2026-53486: Node.js Decompress Path Traversal Flaw

CVE-2026-53486 Overview

CVE-2026-53486 is a path traversal vulnerability [CWE-22] in the decompress package for Node.js, a widely used library for extracting archive files. Versions prior to 10.2.1 and 11.1.3 allow a crafted archive to read or write files outside the intended target directory. The flaw stems from three defects: hardlink and symlink entries are created without validating where the targets point, path containment checks use a naive string prefix comparison, and file modes preserve setuid, setgid, and sticky bits from archive entries. The maintainer released fixes in @xhmikosr/decompress versions 10.2.1 and 11.1.3.

Critical Impact
A malicious archive processed by a vulnerable application can plant or overwrite files anywhere the Node.js process can write, enabling arbitrary file write, configuration tampering, and potential code execution paths on the host.

Affected Products

@xhmikosr/decompress versions prior to 10.2.1
@xhmikosr/decompress versions prior to 11.1.3
Node.js applications that consume the decompress package to extract untrusted archives

Discovery Timeline

2026-07-14 - CVE-2026-53486 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-53486

Vulnerability Analysis

The decompress package processes archive entries and writes them to a caller-specified output directory. Three independent defects combine to break the containment guarantee that consumers expect.

First, symlink and hardlink entries were written to disk without verifying that the link target resolved inside the output directory. An attacker can craft an archive that contains a symlink pointing to /etc or another sensitive path, then a subsequent file entry that writes through the symlink.

Second, path containment used a JavaScript string prefix comparison (realParentPath.indexOf(realOutputPath) !== 0). This check incorrectly accepts sibling directories that share a prefix, such as /tmp/output-evil when the intended root is /tmp/output.

Third, extracted files retained setuid, setgid, and sticky bits from archive metadata. An attacker who can write a setuid binary owned by a privileged user could escalate privileges when that binary is later executed.

Root Cause

The root cause is missing link-target validation combined with a substring-based path check. The fixes introduce a strict isInsideOutput helper that uses path.relative to reject .. traversal and absolute paths, and an ensureLinkTargetInsideOutput helper that resolves link targets against the real output path before creation. File modes are additionally masked with 0o777 to strip the high permission bits.

Attack Vector

Exploitation requires a victim application to extract an attacker-controlled archive using a vulnerable version of decompress. This scenario is common in build pipelines, plugin loaders, user-upload processing services, and package registries. No authentication or user interaction is required against the extraction service itself.

javascript

// Security patch from commit 9fcda4b0 - proper containment check
const isInsideOutput = (target, root) => {
    const rel = path.relative(root, target);
    // '' is the dir itself; a `..` or an absolute path (different drive on Windows) is outside it
    return rel === '' || (rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel));
};

const safeMakeDir = (dir, realOutputPath) => realpath(dir)
    .catch(_ => {
        const parent = path.dirname(dir);
        return safeMakeDir(parent, realOutputPath);
    })
    .then(realParentPath => {
        if (!isInsideOutput(realParentPath, realOutputPath)) {
            throw new Error('Refusing to create a directory outside the output path.');
        }
        return mkdir(dir, {recursive: true}).then(() => realpath(dir));
    });

const ensureLinkTargetInsideOutput = (linkname, linkBase, realOutputPath) => {
    const target = path.resolve(linkBase, linkname);
    if (!isInsideOutput(target, realOutputPath)) {
        return Promise.reject(new Error(`Refusing to create a link pointing outside the output directory: ${target}`));
    }
};

Source: GitHub commit 9fcda4b0

javascript

// Security patch from commit 60b52994 - strip setuid/setgid/sticky bits
return Promise.all(files.map(async x => {
    const dest = path.join(output, x.path);
    // Never honor setuid/setgid/sticky bits from an archive
    const mode = (x.mode & 0o777) & ~process.umask(); // eslint-disable-line no-bitwise
    const now = new Date();

    if (x.type === 'directory') {

Source: GitHub commit 60b52994

Detection Methods for CVE-2026-53486

Indicators of Compromise

Files appearing outside the expected extraction directory after archive processing, particularly under /etc, /root, ~/.ssh, or CI workspace parents.
Newly created symlinks or hardlinks inside extraction targets whose readlink output resolves outside the output root.
Extracted binaries carrying setuid or setgid bits that were not present in the source project's expected artifacts.

Detection Strategies

Perform software composition analysis (SCA) on package-lock.json, yarn.lock, and pnpm-lock.yaml files to flag decompress versions below 10.2.1 and 11.1.3.
Audit runtime file writes originating from Node.js processes that invoke decompress, alerting on writes outside the declared output directory.
Instrument extraction routines to log each resolved destination path and cross-check against the intended root before commit.

Monitoring Recommendations

Monitor filesystem telemetry for setuid or setgid bit changes on files created by Node.js worker processes.
Alert on symlink creation events where the target resolves to a path outside the process working directory.
Track archive-processing services for anomalous parent-directory writes, unusual filenames containing .., or absolute paths in archive entries.

How to Mitigate CVE-2026-53486

Immediate Actions Required

Upgrade @xhmikosr/decompress to version 10.2.1 or 11.1.3 across all applications and container images.
Rebuild and redeploy any Node.js service that extracts untrusted archives, then rotate credentials that may have been exposed through writable paths.
Inventory transitive dependencies with npm ls decompress or npm ls @xhmikosr/decompress to locate indirect exposure.

Patch Information

The maintainer published fixes in GitHub Release v10.2.1 and GitHub Release v11.1.3. Full details are available in the GitHub Security Advisory GHSA-mp2f-45pm-3cg9. The fixes are distributed across commits 281cefa0, 60b52994, 9fcda4b0, and aca5aac4.

Workarounds

Extract archives from untrusted sources inside isolated containers or chroot environments with read-only mounts on sensitive paths.
Wrap decompress calls with a post-extraction validator that resolves each output path via fs.realpath and rejects any file outside the target directory.
Drop setuid and setgid bits from extracted files with an explicit chmod sweep until upgrades are complete.

bash

# Upgrade the fixed package in your project
npm install @xhmikosr/decompress@11.1.3
# Or for the 10.x line
npm install @xhmikosr/decompress@10.2.1

# Audit for vulnerable versions across the dependency tree
npm ls decompress
npm ls @xhmikosr/decompress
npm audit --production

# Post-extraction hardening: strip setuid/setgid/sticky bits
find /path/to/extracted -type f -perm /7000 -exec chmod a-st {} \;