The decompress library, when running a version older than 4.2.2, accepts archive entries that are marked as symlinks and passes the link target retrieved from the archive unchanged to the Node.js fs.symlink() function. This behaviour allows an attacker to craft an archive containing a symlink pointing to arbitrary files outside the intended extraction directory, such as /etc/passwd or other sensitive configuration files. When the application later reads the contents of the extracted files, the symlink is resolved and the attacker can read data that the application was not intended to expose. The weakness maps to directory or path traversal style flaws (CWE-59, CWE-61) that lead to unintended information disclosure.

Any Node.js application that incorporates the decompress npm module with a version lower than 4.2.2 for processing ZIP, TAR, or other archive formats is affected. Common contexts include web services that accept file uploads, continuous‑integration pipelines that import artifacts, or content import utilities that use decompress to extract user‑supplied archives. The issue is also recorded in the CPE database as redhat:hummingbird 1, indicating responsibility from RedHat’s Hummingbird initiative. The specific contexts mentioned are inferred from the description and are not explicitly provided in the input.

The CVSS score of 7.5 classifies this flaw as high risk when present. The EPSS score of less than 1% indicates a very low probability of public exploitation at the time of analysis, and the vulnerability is not included in the CISA KEV catalog. An attacker can exploit the flaw by delivering a malicious archive that contains a crafted symlink entry; no additional privileges or post‑exploit steps are required. If the application reads or processes the extracted files, the attacker can read files outside the extraction directory, leading to information disclosure.