Uncontrolled Resource Consumption in ExcelJS by ExcelData
CVE-2026-78206

8.7HIGH

Key Information:

Vendor

Exceljs

Status
Exceljs
Vendor
CVE Published:
24 August 2026

What is CVE-2026-78206?

The ExcelJS library, specifically versions before 5.0.0, suffers from an uncontrolled resource consumption vulnerability. When handling xlsx archives, the library decompresses files into memory without imposing limitations on entry size, total size, or compression ratio. This flaw enables attackers to exploit the library by uploading highly compressed workbooks. These can expand significantly when decompressed, potentially consuming gigabytes of memory, exhaust system resources, and lead to a denial of service. It is crucial for users to upgrade to version 5.0.0 or later to mitigate this risk.

Affected Version(s)

exceljs 0 <= 4.4.0

References

https://github.com/exceljs/exceljs
product
https://github.com/mateocallec/exceljs-hardened/security/...
third-party-advisory
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/x...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matéo Florian Callec
.