CVE-2026-78206 — exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highl…
Published: 2026-08-24 · CVSS: 8.7 · CVSS 4.0
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7