exceljs-hardened npm Package Vulnerability: What We Know
EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
- Severity
- CRITICAL
- CVSS
- 9.4
- Affected component
- exceljs-hardened (npm)
- Affected versions
- >= v4.4.0, <= v4.4.0 or >= v4.3.0, <= v4.3.0 or >= v4.2.1, <= v4.2.1 or >= v4.2.0, <= v4.2.0 or >= v4.1.1, <= v4.1.1 or >= v4.1.0, <= v4.1.0 or >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0 or >= v3.10.0, <= v3.10.0 or >= v3.9.0, <= v3.9.0 or >= v3.8.2, <= v3.8.2 or >= v3.8.1, <= v3.8.1 or >= v3.8.0, <= v3.8.0 or >= v3.7.0, <= v3.7.0 or >= v3.5.0, <= v3.5.0 or >= v3.4.0, <= v3.4.0 or >= v3.3.1, <= v3.3.1 or >= v3.3.0, <= v3.3.0 or >= v3.2.0, <= v3.2.0 or >= v3.1.0, <= v3.1.0 or >= v3.0.0, <= v3.0.0 or >= v2.0.1, <= v2.0.1 or >= v2.0.0, <= v2.0.0 or >= v1.15.0, <= v1.15.0 or >= v1.14.0, <= v1.14.0 or >= v1.13.0, <= v1.13.0 or >= v1.12.2, <= v1.12.2 or >= v1.12.1, <= v1.12.1 or >= v1.12.0, <= v1.12.0 or >= v1.11.0, <= v1.11.0 or >= v1.10.0, <= v1.10.0 or >= v1.9.1, <= v1.9.1 or >= v1.9.0, <= v1.9.0 or >= v1.8.0, <= v1.8.0 or >= v1.7.0, <= v1.7.0 or >= v1.6.3, <= v1.6.3 or >= v1.6.2, <= v1.6.2 or >= v1.6.1, <= v1.6.1 or >= v1.6.0, <= v1.6.0 or >= v1.5.1, <= v1.5.1 or >= v1.5.0, <= v1.5.0 or >= v1.4.13, <= v1.4.13 or >= v1.4.12, <= v1.4.12 or >= v1.4.11, <= v1.4.11 or >= v1.4.10, <= v1.4.10 or >= v1.4.9, <= v1.4.9 or >= v1.4.8, <= v1.4.8 or >= v1.4.7, <= v1.4.7 or >= v1.4.6, <= v1.4.6 or >= v1.4.5, <= v1.4.5 or >= v1.4.4, <= v1.4.4 or >= v1.4.3, <= v1.4.3 or >= v1.3.0, <= v1.3.0 or >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.3, <= v1.1.3 or >= v1.1.2, <= v1.1.2 or >= v1.1.1, <= v1.1.1 or >= v1.1.0, <= v1.1.0 or >= v1.0.2, <= v1.0.2 or >= v1.0.1, <= v1.0.1 or >= v1.0.0, <= v1.0.0 or >= v0.9.1, <= v0.9.1 or >= v0.9.0, <= v0.9.0 or >= v0.8.5, <= v0.8.5 or >= v0.8.4, <= v0.8.4 or >= v0.8.3, <= v0.8.3 or >= v0.8.2, <= v0.8.2 or >= v0.8.1, <= v0.8.1 or >= v0.8.0, <= v0.8.0 or >= v0.7.1, <= v0.7.1 or >= v0.7.0, <= v0.7.0 or >= v0.6.2, <= v0.6.2 or >= v0.5.1, <= v0.5.1 or >= v0.6.0, <= v0.6.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.14, <= v0.4.14 or >= v0.4.13, <= v0.4.13 or >= v0.4.12, <= v0.4.12 or >= v0.4.11, <= v0.4.11 or >= v0.4.10, <= v0.4.10 or >= v0.4.9, <= v0.4.9 or >= v0.2.36, <= v0.2.36 or >= 0.2.36, <= 0.2.36 or >= v0.2.35, <= v0.2.35 or >= 0.2.35, <= 0.2.35 or >= v0.2.34, <= v0.2.34 or >= 0.2.34, <= 0.2.34 or >= v0.2.33, <= v0.2.33 or >= 0.2.33, <= 0.2.33 or >= v0.2.31, <= v0.2.31 or >= 0.2.31, <= 0.2.31 or >= v0.2.30, <= v0.2.30 or >= 0.2.30, <= 0.2.30 or >= v0.2.29, <= v0.2.29 or >= 0.2.29, <= 0.2.29 or >= v0.2.28, <= v0.2.28 or >= 0.2.28, <= 0.2.28 or >= v0.2.27, <= v0.2.27 or >= 0.2.27, <= 0.2.27 or >= v0.2.26, <= v0.2.26 or >= 0.2.26, <= 0.2.26 or >= v0.2.24, <= v0.2.24 or >= 0.2.24, <= 0.2.24 or >= v0.2.23, <= v0.2.23 or >= 0.2.23, <= 0.2.23 or >= v0.2.22, <= v0.2.22 or >= 0.2.22, <= 0.2.22 or >= v0.2.21, <= v0.2.21 or >= 0.2.21, <= 0.2.21 or >= v0.2.20, <= v0.2.20 or >= 0.2.20, <= 0.2.20 or >= v0.2.19, <= v0.2.19 or >= 0.2.19, <= 0.2.19 or >= v0.2.18, <= v0.2.18 or >= 0.2.18, <= 0.2.18 or >= v0.2.17, <= v0.2.17 or >= 0.2.17, <= 0.2.17 or >= v0.2.16, <= v0.2.16 or >= 0.2.16, <= 0.2.16 or >= v0.2.15, <= v0.2.15 or >= 0.2.15, <= 0.2.15 or >= v0.2.12, <= v0.2.12 or >= 0.2.12, <= 0.2.12 or >= v0.2.11, <= v0.2.11 or >= 0.2.11, <= 0.2.11 or >= v0.2.10, <= v0.2.10 or >= 0.2.10, <= 0.2.10 or >= v0.2.8, <= v0.2.8 or >= 0.2.8, <= 0.2.8 or >= v0.2.3, <= v0.2.3 or >= 0.2.3, <= 0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= 0.2.2, <= 0.2.2 or >= 0.2.1, <= 0.2.1 or >= v0.2.0, <= v0.2.0 or >= 0.2.0, <= 0.2.0 or >= v0.1.11, <= v0.1.11 or >= 0.1.11, <= 0.1.11 or >= v0.1.10, <= v0.1.10 or >= 0.1.10, <= 0.1.10 or >= v0.1.9, <= v0.1.9 or >= 0.1.9, <= 0.1.9 or >= v0.1.8, <= v0.1.8 or >= 0.1.8, <= 0.1.8 or >= v0.1.7, <= v0.1.7 or >= 0.1.7, <= 0.1.7 or >= v0.1.6, <= v0.1.6 or >= 0.1.6, <= 0.1.6 or >= v0.1.5, <= v0.1.5 or >= 0.1.5, <= 0.1.5 or >= v0.1.4, <= v0.1.4 or >= 0.1.4, <= 0.1.4 or >= v0.1.3, <= v0.1.3 or >= 0.1.3, <= 0.1.3 or >= v0.1.2, <= v0.1.2 or >= 0.1.2, <= 0.1.2 or >= v0.1.1, <= v0.1.1 or >= 0.1.1, <= 0.1.1 or >= v0.1.0, <= v0.1.0 or >= 0.1.0, <= 0.1.0 or >= v0.0.9, <= v0.0.9 or >= 0.0.9, <= 0.0.9 or >= v0.0.8, <= v0.0.8 or >= 0.0.8, <= 0.0.8 or >= v0.0.7, <= v0.0.7 or >= 0.0.7, <= 0.0.7 or >= v0.0.6, <= v0.0.6 or >= 0.0.6, <= 0.0.6 or >= v0.0.5, <= v0.0.5 or >= 0.0.5, <= 0.0.5 or >= v0.0.4, <= v0.0.4 or >= 0.0.4, <= 0.0.4 or >= v0.0.3, <= v0.0.3 or >= 0.0.3, <= 0.0.3 or >= v0.0.2, <= v0.0.2 or >= 0.0.2, <= 0.0.2 or >= v0.0.1, <= v0.0.1 or >= 0.0.1, <= 0.0.1
- Patched version
- 5.0.0
CVE-2026-78207
The exceljs-hardened npm package before version 5.0.0 reportedly contains a critical prototype pollution vulnerability. Users of this package should assess their exposure and take appropriate action.
What happened
The exceljs-hardened npm package before version 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper. This vulnerability allows attackers to assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process. The vulnerability has been assigned CVE-2026-78207 with a CVSS score of 9.4, indicating a critical severity level.
The vulnerability was first flagged on 2026-08-24T01:16:58.137000+00:00. It is not yet confirmed to be exploited in the wild. The affected versions include all versions from 0.0.1 to 4.4.0. The recommended action is to upgrade to exceljs-hardened@5.0.0 or later to mitigate the vulnerability.
What to do about it
- Identify all instances where exceljs-hardened is used in your projects.
- Check the version of exceljs-hardened in use. If it is before 5.0.0, you are affected.
- Upgrade to exceljs-hardened@5.0.0 or later to mitigate the prototype pollution vulnerability.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps.
- Consider implementing additional security measures to protect against similar vulnerabilities in the future.
How 0Day would have caught this
MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If
exceljs-hardened is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using exceljs-hardened npm package in versions from 0.0.1 to 4.4.0, you are affected.
What should I do right now?
Upgrade to exceljs-hardened@5.0.0 or later to mitigate the vulnerability.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Where can I find more information about this vulnerability?
Consult the primary sources provided, including the CVE-2026-78207 page on the NVD website.