n8n-io/n8n · error · Error

"${fileName}" has too many archive entries (${entryCount} >

Error message

"${fileName}" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.

What it means

Error ""${fileName}" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb." thrown in n8n-io/n8n.

Source

Thrown at packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts:41

function formatMB(bytes: number): string {
	return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
}

/**
 * Reads the ZIP central directory of `buffer` and throws when the archive declares
 * more than `MAX_OOXML_UNCOMPRESSED_BYTES` of uncompressed data or more than
 * `MAX_OOXML_ENTRIES` entries. A buffer without a readable central directory is
 * left untouched — it isn't a valid OOXML archive and the downstream parser will
 * reject it (the compressed size is already bounded).
 */
export function assertOoxmlWithinBounds(buffer: Buffer, fileName: string): void {
	const eocd = findEndOfCentralDirectory(buffer);
	if (eocd === undefined) return;

	const entryCount = buffer.readUInt16LE(eocd + 10);
	if (entryCount > MAX_OOXML_ENTRIES) {
		throw new Error(
			`"${fileName}" has too many archive entries (${entryCount} > ${MAX_OOXML_ENTRIES}); refusing to parse a potential decompression bomb.`,
		);
	}

	let offset = buffer.readUInt32LE(eocd + 16);
	let totalUncompressed = 0;
	for (let i = 0; i < entryCount; i++) {
		if (offset + CENTRAL_FILE_HEADER_MIN_SIZE > buffer.length) break;
		if (buffer.readUInt32LE(offset) !== CENTRAL_FILE_HEADER_SIGNATURE) break;

		const uncompressed = buffer.readUInt32LE(offset + 24);
		// A ZIP64 marker means the real size doesn't fit in 32 bits (>= 4 GB) — well
		// past any sane bound, so reject without decoding the ZIP64 extra field.
		if (uncompressed === ZIP64_SIZE_MARKER) {
			throw new Error(
				`"${fileName}" declares a ZIP64-sized entry; refusing to parse a potential decompression bomb.`,
			);
		}

View on GitHub (pinned to 5ac6606e81)

When it happens

Trigger: Thrown at packages/@n8n/instance-ai/src/parsers/ooxml-guard.ts:41 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/dcf4fd2f7997216b. Report an issue: GitHub.