CVE-2026-78206: exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
exceljsto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using exceljs through 4.4.0 or exceljs-hardened before 5.0.0 are affected when they process supplied XLSX archives. The impact occurs because archive entries are decompressed into memory without limits on entry size, aggregate size, or compression ratio.
What does an attacker need to exploit the issue?
An attacker needs to provide a specially crafted, highly compressed XLSX workbook for the application to process. No privileges or user interaction are required according to the supplied severity vector.
What is the practical impact of a malicious workbook?
A compressed workbook can expand to gigabytes in memory during processing, exhausting available resources. This can cause the affected application or service to become unavailable.