Description

exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-24T01:16:57.973Z",
  "pubdate": "2026-08-24T01:16:57.973Z",
  "executiveSummary": "ExcelJS-hardened before version 5.0.0 suffers from an uncontrolled resource consumption vulnerability stemming from the lack of validation during the decompression of archive entries.\nThe vulnerability allows malicious actors to execute a denial of service attack by uploading specifically crafted, highly compressed spreadsheet workbooks designed to expand exponentially when processed.\nWhen the vulnerable component parses these archives, it decompresses all entries directly into memory without imposing limits on individual entry size, aggregate uncompressed size, or high compression ratios, commonly known as a zip bomb attack.\nThe resulting memory exhaustion causes the hosting application process to crash, disrupting service availability for legitimate users.\nExploitation requires the ability to supply a malicious workbook file to the application parsing mechanism.\nThe risk implication is critical for Node.js environments processing untrusted spreadsheet uploads, as successful exploitation results in immediate service disruption without requiring authentication or elevated privileges.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of resource constraints and input validation within the decompression routines of the affected library.\nSpecifically, exceljs-hardened before version 5.0.0 reads and extracts all entries from supplied xlsx archives into system memory without implementing safeguards against decompression bombs.\nAn attacker exploits this behavior by constructing a malicious archive containing entries with deceptive compression headers.\nThe attack flow begins when an application utilizing the vulnerable library receives and attempts to parse the untrusted spreadsheet file.\nThe parser iterates through the archive entries and initiates decompression streams.\nDue to the absence of size thresholds or total payload tracking, a small physical file containing heavily compressed data rapidly expands upon extraction, consuming gigabytes of heap memory in fractions of a second.\nThis sudden and uncontrolled allocation exhausts the available memory resources of the Node.js runtime environment.\nThe payload behavior triggers an unhandled out-of-memory exception, forcing the termination of the Node.js process and resulting in a complete denial of service.\nNetwork exposure depends on the application architecture, but typically affects web services, file upload portals, or API endpoints that accept and process xlsx files from external users.\nAuthentication and privilege requirements are generally negligible, as the attack vector is exposed to any user or anonymous entity capable of submitting a file upload payload to the vulnerable endpoint."
}