Archive extraction escapes: what path traversal means for Node.js teams

TL;DR: CVE-2026-101894 in @xhmikosr/decompress lets crafted tar, ZIP, and similar archives resolve symlink chains outside the chosen output directory, according to Safe Security, with extraction-time outside writes observed on vulnerable releases and fixed in 11.1.4 and 10.2.2. Boundary checks that rely on lexical resolution plus delayed realpath handling can fail when link creation and file extraction interleave.

Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress”.

By the numbers:

• CVE-2026-101894 is rated critical with a CVSS v3.1 score of 9.1 / 10.
• The vulnerability affects @xhmikosr/decompress 11.0.0 through 11.1.3 and 10.2.1 and earlier.
• The supplied 300-attempt sessions recorded 19 outside writes on 11.1.3 and 20 on 10.2.1.

Key questions

Q: What breaks when archive extraction trusts symlink chains inside untrusted files?

A: The extractor can write outside the intended destination because the path that looks safe lexically may resolve to a different place once the filesystem follows planted links.

Q: Why do archive path traversal bugs create such high operational risk?

A: They can change host state during ordinary automation, including overwriting files, planting directories, or preparing later execution paths.

Q: What are the signs that archive containment checks are failing?

A: Look for extraction results that vary across repeated runs, especially when the same archive sometimes stays inside the target tree and sometimes creates outside files or directories.

Practitioner guidance

• Harden archive extraction boundaries Run untrusted archive extraction in a dedicated process with the smallest possible filesystem view and no direct access to sensitive host paths.
• Reject link-based archive escapes Validate symlink and hardlink targets against the real destination tree before any file write is committed, not after extraction returns.
• Restrict service-account write scope Limit the credentials and filesystem permissions used by build agents and deployment workers so a single archive cannot overwrite arbitrary host files.

Bottom line: The core issue is not simple path parsing but a filesystem boundary failure that lets crafted archive entries escape the intended directory.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →