---
id: CVE-2026-78206
title: >-
  exceljs through 4.4.0 decompresses all entries from supplied xlsx archives
  into memory without limits on entry size, total size, or compression ratio
summary: >-
  exceljs through 4.4.0 decompresses all entries from supplied xlsx archives
  into memory without limits on entry size, total size, or compression ratio.
  Attackers can upload highly compressed workbooks that expand to gigabytes in
  memory, e…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-409
published: '2026-08-24'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78206'
references:
  - url: 'https://github.com/exceljs/exceljs'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0063
epssPercentile: 0.4796
ingestedAt: '2026-08-29T21:42:33.158Z'
---

## Overview

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.