Medium [CVE-2026-39243] File disclosure and corruption via arbitrary hardlink creation

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113).

An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content.

Hardlinks are limited to files on the same filesystem and cannot target directories. A flaw was found in decompress.

An attacker can craft a malicious archive that, when extracted, allows for arbitrary hardlink creation. This could lead to sensitive file read disclosure or file corruption on the system.

This Moderate flaw in the `decompress` library allows an attacker to create arbitrary hardlinks during archive extraction. By crafting a malicious archive, an attacker could exploit this to disclose sensitive file contents or corrupt files on the same filesystem where the archive is extracted.

This risk is present in Red Hat products that utilize the `decompress` library for archive handling.