CVE-2026-78206

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWE

CWE-409

Published

2026-08-24

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

References

• https://github.com/exceljs/exceljs
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281
• https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q
• https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression

Check your stackJSON