Description
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Published: 2026-08-24
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Description exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Title exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
First Time appeared Exceljs Project
Exceljs Project exceljs
Weaknesses CWE-409
CPEs cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*
Vendors & Products Exceljs Project
Exceljs Project exceljs
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Exceljs Project Exceljs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-24T00:30:46.462Z

Reserved: 2026-08-24T00:15:01.655Z

Link: CVE-2026-78206

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T01:16:57.973

Modified: 2026-08-24T01:16:57.973

Link: CVE-2026-78206

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses