CVE-2026-78206CWE-409

CVE-2026-78206

High · published August 24, 2026

CVSS v3.1

7.5

EPSS

Percentile

49.5

In the wild

Unconfirmed

What it is

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00630 · 49.5th percentile
Weakness: CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published: 2026-08-24T05:16Z

References (4)

https://github.com/exceljs/exceljs · [email protected]https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281 · [email protected]https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q · [email protected]https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression · [email protected]

EPSS history

Timeline

24 AUG 00:30Z
exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
cvelistv5