exceljs processes every entry in uploaded XLSX files fully in memory without limits on entry size or compression ratio. An attacker can supply a highly compressed workbook that expands to multiple gigabytes, consuming all available memory and causing the process to become unresponsive or terminate. This results in denial of service, and the vulnerability is classified as CWE‑409.

The exploit affects the exceljs library; versions up to 4.4.0 are vulnerable. The library is identified by Vendor "exceljs" and Product "exceljs".

The CVSS score of 8.7 indicates high severity. The EPSS score is 0.00446, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an attacker uploading a crafted XLSX file to an application that uses exceljs to parse workbooks. Because the library accepts the file without external validation, the exploit can be performed by anyone who can influence the file content, thus posing a significant risk for availability.