Executive brief
exceljs is a popular Node.js library for reading and writing Excel workbooks. Versions through 4.4.0 fail to validate the size of decompressed data from xlsx archives, allowing attackers to upload specially crafted files that expand to gigabytes in memory and crash the application, disrupting service for all users.
Technical details
This is a classic zip bomb vulnerability (CWE-409) affecting archive decompression. The vulnerability exists in exceljs's xlsx parsing logic, which decompresses all entries from a supplied archive into memory without enforcing limits on individual entry sizes, total decompressed size, or compression ratios. An attacker can craft a malicious xlsx file containing highly compressed payloads (e.g., a 1MB file that decompresses to several GB) that, when processed by a server using exceljs, exhausts available memory and causes denial of service. The attack requires only the ability to upload or provide an xlsx file to a system using the affected library; no authentication or special privileges are needed if file uploads are publicly available. Patches should implement decompression limits or stream-based processing to prevent memory exhaustion.
Affected products
- exceljs exceljs through 4.4.0
Timeline
- 2026-08-24: disclosed
- other: CVE-2026-78206 assigned