CVE-2026-78206High· 7.5▾ Twilightexceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, e…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.6%
Last analysed / modified upstream
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-8814Medium· 5.3Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size
CVE-2026-116662High· 7.5Tanium addressed a compression bomb vulnerability in Enforce.
CVE-2026-65627Medium· 6.9Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
CVE-2026-116579Medium· 5.9Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
CVE-2026-93850Medium· 6.5Unbounded memory consumption during PDF text extraction
CVE-2026-109584High· 8.7HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit