External risk intelligence

Node.js decompress Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-53486

This is a library used within Node.js applications to extract archives. While it can be utilized in web applications that process user-uploaded files, it is a developer-focused utility package rather than an internet-facing service, appliance, or gateway itself. Public internet exposure is dependent on specific application implementation, making direct exposure uncommon.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a Node.js package used for archive extraction, allowing crafted archives to potentially access or modify files outside their intended directories. This could lead to unauthorized data access or modification if vulnerable applications process untrusted archives. The main concern is confirming relevance and exposure within our specific application environments.

Archive extraction can allow unauthorized file access.
Confirms potential for data compromise through file operations.
Understand relevance to confirm potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user or application into extracting a specially crafted archive. The `decompress` package's handling of hardlinks and symlinks, combined with insufficient path validation, allows the extracted files to be written or read outside the intended directory. This could lead to unauthorized access or modification of sensitive files on the system.

Archive extraction requires user interaction.
Malicious archive can write/read outside directory.
Risk of unauthorized file access or modification.

Live Threat

Current exploitation, exposure, and threat context

When this Node.js package extracts archives, a specially crafted archive could allow an attacker to create or modify files outside the intended extraction directory. This could impact system data, user data, or service behavior when the package is used to process untrusted archives.

System or user files at risk.
Malicious archive can overwrite files.
Unrestricted file access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world responsibility for this vulnerability likely falls to application owners and platform teams managing Node.js environments. The first practical step is to identify all instances where the `decompress` package is used, assess their exposure and business criticality, and then confirm the accountable owner before planning remediation.

Identify accountable application owners.
Verify package usage and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the decompress package for Node.js?

The decompress package is a utility library for Node.js environments designed to programmatically extract various archive formats. Developers commonly integrate it into applications to handle file uploads or process compressed data streams. Because it acts as a background processing tool, it functions as a component within larger software architectures rather than a standalone service.

How does CVE-2026-53486 create a security risk?

This vulnerability involves Path Traversal (CWE-22) and Improper Link Following (CWE-59). The library fails to properly validate destination paths during extraction, allowing a malicious archive to bypass intended directory constraints. By manipulating file references or symbolic links within the archive, an attacker can trick the system into writing or reading files in restricted areas of the underlying file system.

Do I need to worry about local archives?

The risk is specifically triggered when the application processes untrusted, crafted archives. Simply having the package installed is not the trigger. The vulnerability is only realized when the software is instructed to extract a malicious file; if you only use the library to process archives from trusted, internal sources that you control and verify, you are not exercising the flawed code path.

Is my application reachable by this threat?

According to Halo Surface Signal, this is a developer utility, not an internet-facing gateway. Your risk depends on whether your application automatically processes files uploaded by external users. If your service allows users to upload archives that the system then extracts, it is a higher priority than an internal tool that never handles untrusted input from the public internet.

Why should I update my Node.js dependencies?

Updating to version 10.2.1 or 11.1.3 is the primary way to remove this risk, as these versions include hardened path validation and security checks for file permissions. Start by checking your project's dependency manifest to see if you use an affected version. If so, coordinate with your development team to test and deploy the patched library to neutralize the unauthorized file access vector.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.