{"record":{"id":"dcf4fd2f7997216b","repo":"n8n-io/n8n","slug":"filename-has-too-many-archive-entries-entr","errorCode":null,"errorMessage":"\"${fileName}\" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.","messagePattern":"\"(.+?)\" has too many archive entries \\((.+?) > (.+?)\\); refusing to parse a potential decompression bomb\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts","lineNumber":41,"sourceCode":"\nfunction formatMB(bytes: number): string {\n\treturn `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n}\n\n/**\n * Reads the ZIP central directory of `buffer` and throws when the archive declares\n * more than `MAX_OOXML_UNCOMPRESSED_BYTES` of uncompressed data or more than\n * `MAX_OOXML_ENTRIES` entries. A buffer without a readable central directory is\n * left untouched — it isn't a valid OOXML archive and the downstream parser will\n * reject it (the compressed size is already bounded).\n */\nexport function assertOoxmlWithinBounds(buffer: Buffer, fileName: string): void {\n\tconst eocd = findEndOfCentralDirectory(buffer);\n\tif (eocd === undefined) return;\n\n\tconst entryCount = buffer.readUInt16LE(eocd + 10);\n\tif (entryCount > MAX_OOXML_ENTRIES) {\n\t\tthrow new Error(\n\t\t\t`\"${fileName}\" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.`,\n\t\t);\n\t}\n\n\tlet offset = buffer.readUInt32LE(eocd + 16);\n\tlet totalUncompressed = 0;\n\tfor (let i = 0; i < entryCount; i++) {\n\t\tif (offset + CENTRAL_FILE_HEADER_MIN_SIZE > buffer.length) break;\n\t\tif (buffer.readUInt32LE(offset) !== CENTRAL_FILE_HEADER_SIGNATURE) break;\n\n\t\tconst uncompressed = buffer.readUInt32LE(offset + 24);\n\t\t// A ZIP64 marker means the real size doesn't fit in 32 bits (>= 4 GB) — well\n\t\t// past any sane bound, so reject without decoding the ZIP64 extra field.\n\t\tif (uncompressed === ZIP64_SIZE_MARKER) {\n\t\t\tthrow new Error(\n\t\t\t\t`\"${fileName}\" declares a ZIP64-sized entry; refusing to parse a potential decompression bomb.`,\n\t\t\t);\n\t\t}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts#L23-L59","documentation":"Error \"\"${fileName}\" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.\" thrown in n8n-io/n8n.","triggerScenarios":"Thrown at packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts:41 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}