EXCELJS · CVE-2026-128338 · Package
FIX → 5.1.0
exceljs through 4.4.0 trusts the max attribute of a worksheet column element without a bound. A small workbook with a huge max value makes xlsx.load() allocate hundreds of millions of Column objects until the process aborts with an out-of-memory error.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use exceljs to parse .xlsx files from untrusted sources, such as user uploads or imports from external systems, are exposed. Applications that only write spreadsheets or only read files the team controls can skip it.
Not affected if no-untrusted-xlsx-input, writes-only
Who cares denial-of-service, exceljs, node, nodejs, npm, spreadsheet-import
npm ls exceljs (and npm ls exceljs-hardened): exceljs <= 4.4.0 is affected; exceljs-hardened <= 5.0.2 is affected, 5.1.0 is patched.xlsx.load(), readFile() or streaming readers fed by uploads or imports from outside your team. Apps that only write xlsx files can skip it.exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 5.1.0
v4.4.0, which is affected5.1.0 as patched for the same bug (GHSA-w57r-3mm6-w6g7, affected <= 5.0.2)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.