CVE-2026-78206 affects exceljs-hardened versions before 5.0.0, which decompresses all entries from supplied XLSX archives into memory without enforcing limits on entry size, total decompressed size, or compression ratio. This vulnerability enables a zip bomb-style attack where an attacker uploads a highly compressed workbook that expands to gigabytes in memory upon decompression. The result is exhaustion of available system resources, leading to denial of service. The flaw originates in the underlying exceljs library's xlsx parsing logic. A security advisory has been published by the maintainer of exceljs-hardened via GitHub. VulnCheck has also documented this as an uncontrolled resource consumption vulnerability. Users are advised to upgrade to exceljs-hardened version 5.0.0 or later to remediate the issue.
