Quick answers
- Is CVE-2026-78206 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78206 being exploited in the wild.
- How severe is CVE-2026-78206?
- High severity, with a CVSS score of 7.5, published 24 August 2026.
- Which products and versions are affected?
- exceljs exceljs through 4.4.0.
- Is there a fix for CVE-2026-78206?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-78206 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78206?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a classic zip bomb vulnerability (CWE-409) affecting archive decompression. The vulnerability exists in exceljs's xlsx parsing logic, which decompresses all entries from a supplied archive into memory without enforcing limits on individual entry sizes, total decompressed size, or compression ratios. An attacker can craft a malicious xlsx file containing highly compressed payloads (e.g., a 1MB file that decompresses to several GB) that, when processed by a server using exceljs, exhausts available memory and causes denial of service. The attack requires only the ability to upload or provide an xlsx file to a system using the affected library; no authentication or special privileges are needed if file uploads are publicly available. Patches should implement decompression limits or stream-based processing to prevent memory exhaustion.
Affected products
- exceljs exceljs through 4.4.0
Timeline
- 2026-08-24: disclosed
- other: CVE-2026-78206 assigned