High-Severity 'decompress' npm Vulnerability (CVE-2026-53486) Threatens 2.8 Million Weekly Downloads

A critical vulnerability, CVE-2026-53486, has been identified in the 'decompress' npm package, allowing crafted archives to write files outside the intended extraction folder. With a CVSS score of 9.1, this flaw affects a library downloaded over 2.8 million times weekly. The vulnerability impacts all formats handled by the library, including tar and zip, and poses a significant supply chain security risk, especially when run with elevated privileges. Patches are available in versions 10.2.1 and 11.1.3.

Context

The 'decompress' npm package is a popular tool used for handling various archive formats, including tar and zip, and is downloaded over 2.8 million times each week. The vulnerability allows attackers to craft malicious archives that can write files outside designated directories, which is particularly dangerous when the package is run with elevated privileges. This incident underscores the ongoing challenges in software security and the importance of timely updates.

Why it matters

The CVE-2026-53486 vulnerability in the 'decompress' npm package poses a serious security risk to millions of developers and organizations that rely on this widely used library. With a high CVSS score of 9.1, it highlights the potential for exploitation, which could lead to unauthorized file access and manipulation. Addressing this vulnerability is crucial to maintaining the integrity of software supply chains and protecting sensitive data.

Implications

If left unaddressed, this vulnerability could lead to widespread exploitation, affecting countless applications and services that depend on the 'decompress' library. Organizations may face data breaches, loss of sensitive information, and increased security costs. The incident may also prompt a reevaluation of security practices within the software development community, emphasizing the need for proactive vulnerability management.

What to watch

Developers using the 'decompress' package should prioritize updating to the patched versions 10.2.1 and 11.1.3 to mitigate the risk. Observers should monitor the response from the npm community and any potential exploits that may emerge in the wild. Additionally, the impact of this vulnerability on related packages and the broader ecosystem will be important to assess.