GHSA-7cvf-3r55-r39q: exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that accept XLSX files from untrusted users or other untrusted sources and process them with exceljs are exposed. A malicious workbook can consume enough memory to deny service.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates that exploitation is network-reachable and requires neither privileges nor user interaction. An attacker needs a path to submit an XLSX archive for processing.
How can I determine whether my application is affected?
Check whether the application uses the npm package exceljs at version 4.4.0 or earlier and processes supplied XLSX files. The affected behavior is unbounded decompression of archive entries into memory.