Hi,

The following vulnerability was published for node-extract-zip.

CVE-2026-19693[0]:
| extract-zip through 2.0.1 containment-checks only the parent
| directory of each archive entry and never the entry's own final path
| component, so an archive containing two entries with identical names
| - a symlink whose target is outside the destination, followed by a
| regular file - writes through the planted symlink and yields an
| arbitrary file write outside the destination directory.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19693
https://www.cve.org/CVERecord?id=CVE-2026-19693
[1] https://github.com/max-mapper/extract-zip/pull/160

Regards,
Salvatore