Improper Handling of Highly Compressed Data (Data Amplification) Affecting exceljs package, versions *

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via Workbook.xlsx.load() in lib/xlsx/xlsx.js. An attacker can exhaust memory and crash the process by supplying a highly compressible .xlsx file that expands into a very large amount of data during ZIP decompression. Services that call load() or readFile() on untrusted uploads are affected: the workbook loader decompresses archive entries into memory before XML parsing, so a small crafted file can trigger an out-of-memory termination and deny service to users.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Run load() inside a process or container with a hard memory limit, so a decompression bomb can only crash that isolated process instead of exhausting the host.
• Pre-check the uploaded .xlsx file’s declared uncompressed sizes from the ZIP central directory before calling load(), so oversized archives are rejected before decompression begins.

• GitHub Commit
• Maintainer's Advisory
• Vulnerable Code