What’s Vulnerable › Vulnerabilities

CVE-2026-78206: exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-14
• Weakness: CWE-409

Description

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

Affected products

• exceljs: through 4.4.0

References

• https://github.com/exceljs/exceljs
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281
• https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q
• https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression

Get alerted when CVE-2026-78206 or the next vulnerability affects your stack