CVE-2026-78206

CVE-2026-78206 exposes a critical gap in exceljs-hardened: the library accepts and processes Excel files without validating the claimed size against decompressed capacity, allowing decompression bombs. A maliciously crafted spreadsheet with extreme compression ratios (easily achieving 10,000:1 or higher) will cause the parsing process to allocate gigabytes of memory, potentially crashing Node.js processes or exhausting server resources. If you depend on exceljs-hardened versions prior to 5.0.0, treat any untrusted Excel input as a potential resource exhaustion vector. This is not a theoretical concern — the vulnerability exists because the library trusts input file metadata without bounds checking, a pattern that has repeated across document parsers, image processors, and archive extractors for decades. Immediate actions: audit your dependency tree for exceljs-hardened versions below 5.0.0 and upgrade. If upgrading is not immediately feasible, implement preprocessing: before passing any Excel file to exceljs-hardened, validate the file's claimed size against your own configured limits, or route untrusted uploads through a sandboxed worker process with strict memory caps (for example, running Node.js with --max-old-space-size set to a low value). The 5.0.0 release is a major version specifically because enforcing these limits required architectural changes — the original code lacked the abstractions to express resource bounds, not merely a missing validation check. The 'hardened' branding on this library illustrates a persistent blindspot: security reviews routinely focus on content-manipulation attacks (formula injection, script embedding, XSS) while treating resource consumption as an infrastructure concern rather than a code vulnerability. The CVSS 7.5 score is technically accurate but undersells the systemic risk — a library marketed for security shipped without this most elementary input validation for over a year. When taking dependencies on 'hardened' libraries, explicitly verify that resource exhaustion was included in the threat model, not assumed to be covered by the hardening label.

Reviewed through automated stages and approved by a human before publication.