n8n-io/n8n · error · Error

" " declares a ZIP64-sized entry; refusing to parse a…

Error message

"${fileName}" declares a ZIP64-sized entry; refusing to parse a potential decompression bomb.

What it means

The OOXML ZIP guard found a central-directory entry whose uncompressed size field carries the ZIP64 0xFFFFFFFF marker. Legitimate small files never need ZIP64 sizing, so this signals a manipulated or broken archive attempting to hide its true (huge) uncompressed size — a decompression-bomb vector. Parsing is refused before any inflation.

Solutions

  1. Re-save the document with a normal office application to produce a standard ZIP64-free archive
  2. Treat the file as untrusted if it was externally supplied — the size field was deliberately or corruptly malformed
  3. Do not bypass the guard by pre-extracting; the inflated content is what the guard protects against
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts:56 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/edab5d56038b1a68. Report an issue: GitHub.

Appendix: source

Thrown at packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts:56

	const entryCount = buffer.readUInt16LE(eocd + 10);
	if (entryCount > MAX_OOXML_ENTRIES) {
		throw new Error(
			`"${fileName}" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.`,
		);
	}

	let offset = buffer.readUInt32LE(eocd + 16);
	let totalUncompressed = 0;
	for (let i = 0; i < entryCount; i++) {
		if (offset + CENTRAL_FILE_HEADER_MIN_SIZE > buffer.length) break;
		if (buffer.readUInt32LE(offset) !== CENTRAL_FILE_HEADER_SIGNATURE) break;

		const uncompressed = buffer.readUInt32LE(offset + 24);
		// A ZIP64 marker means the real size doesn't fit in 32 bits (>= 4 GB) — well
		// past any sane bound, so reject without decoding the ZIP64 extra field.
		if (uncompressed === ZIP64_SIZE_MARKER) {
			throw new Error(
				`"${fileName}" declares a ZIP64-sized entry; refusing to parse a potential decompression bomb.`,
			);
		}

		totalUncompressed += uncompressed;
		if (totalUncompressed > MAX_OOXML_UNCOMPRESSED_BYTES) {
			throw new Error(
				`"${fileName}" decompresses to more than ${formatMB(MAX_OOXML_UNCOMPRESSED_BYTES)}; refusing to parse a potential decompression bomb.`,
			);
		}

		const nameLen = buffer.readUInt16LE(offset + 28);
		const extraLen = buffer.readUInt16LE(offset + 30);
		const commentLen = buffer.readUInt16LE(offset + 32);
		offset += CENTRAL_FILE_HEADER_MIN_SIZE + nameLen + extraLen + commentLen;
	}
}

View on GitHub (pinned to 5ac6606e81)