{"id":"CVE-2026-128338","kind":"vulnerability","aliases":["CVE-2026-128338"],"related":[],"title":"exceljs: crafted spreadsheet column count crashes apps via memory exhaustion","description":"exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error.","summary":"exceljs through 4.4.0 trusts the max attribute of a worksheet column element without a bound. A small workbook with a huge max value makes xlsx.load() allocate hundreds of millions of Column objects until the process aborts with an out-of-memory error.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"exceljs","fixed":[],"affected":"<= 4.4.0","ecosystem":"npm"},{"name":"exceljs-hardened","fixed":["5.1.0"],"affected":"<= 5.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["denial-of-service","exceljs","node","nodejs","npm","package","spreadsheet-import"],"not_affected_if":["no-untrusted-xlsx-input","writes-only"],"how_to_check":"- Run `npm ls exceljs` (and `npm ls exceljs-hardened`): exceljs <= 4.4.0 is affected; exceljs-hardened <= 5.0.2 is affected, 5.1.0 is patched.\n- Search for `xlsx.load()`, `readFile()` or streaming readers fed by uploads or imports from outside your team. Apps that only write xlsx files can skip it.\n- The crash is a fatal V8 out-of-memory abort, so try/catch does not stop it.","fix":"No fixed release of upstream exceljs found: the latest release on github.com/exceljs/exceljs/releases is v4.4.0, which is affected. The unofficial fork exceljs-hardened (npm) lists 5.1.0 as patched for the same bug (GHSA-w57r-3mm6-w6g7, affected <= 5.0.2). Until upstream ships a fix, reject untrusted xlsx input or pre-validate it.","status":"open","published_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:50:18+00:00","updated_at":"2026-11-13T10:51:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:50:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"exceljs: crafted spreadsheet column count crashes apps via memory exhaustion","impact":"medium","summary":"exceljs through 4.4.0 trusts the max attribute of a worksheet column element without a bound. A small workbook with a huge max value makes xlsx.load() allocate hundreds of millions of Column objects until the process aborts with an out-of-memory error.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node","nodejs","spreadsheet-import"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker crashes the process with an uncatchable out-of-memory abort","analyst_note":"Check the vendor advisory on github.com and the VulnCheck advisory for the fixed version and whether any release after 4.4.0 contains the fix.","how_to_check":"- Check the installed exceljs version with `npm ls exceljs` in the project.\n- Search for code that calls `xlsx.load()` or otherwise parses uploaded or untrusted spreadsheets with exceljs.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx-input","writes-only"],"who_is_affected":"Applications that use exceljs to parse .xlsx files from untrusted sources, such as user uploads or imports from external systems, are exposed. Applications that only write spreadsheets or only read files the team controls can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4620,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor advisory on github.com and the VulnCheck advisory for the fixed version and whether any release after 4.4.0 contains the fix.","search":"'-128338':13A,16A '-2026':12A,15A '4.4.0':35B,78C 'abort':68B,123C 'alloc':58B,115C 'allow':85C 'app':7A 'applic':89C 'attack':86C,101C 'attribut':39B,100C 'bound':47B 'caus':112C 'col':94C 'column':4A,43B,63B,120C 'contain':79C 'count':5A 'craft':2A,103C 'crash':6A,88C 'cve':11A,14A 'denial':22B 'denial-of-servic':21B 'element':44B,95C 'error':75B,134C 'excelj':1A,25B,33B,76C 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':10A,82C 'hardened':20A 'heap':129C 'huge':53B,109C 'hundr':59B,116C 'import':32B 'make':56B 'max':38B,54B,99C,110C 'memori':9A,74B,81C,133C 'million':61B,118C 'node':26B 'nodej':27B 'npm':28B 'object':64B,121C 'out-of-memori':71B,130C 'packag':29B 'process':67B,125C 'servic':24B 'small':49B,105C 'spreadsheet':3A,31B 'spreadsheet-import':30B 'suppli':91C 'trust':36B 'unbound':98C 'uncatch':128C 'valu':55B,111C 'via':8A 'vulner':83C 'without':45B 'workbook':50B,106C 'worksheet':42B,93C 'xlsx.load':57B,113C","nicknames":[],"mitigations":[],"who_affected":"Applications that use exceljs to parse .xlsx files from untrusted sources, such as user uploads or imports from external systems, are exposed. Applications that only write spreadsheets or only read files the team controls can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["exceljs","exceljshardened"],"ptokens":["exceljs","hardened"],"labels":["denialofservice","exceljs","high","node","nodejs","npm","package","spreadsheetimport"],"campaign_type":null,"search_a":"'-128338':13A,16A '-2026':12A,15A 'app':7A 'column':4A 'count':5A 'craft':2A 'crash':6A 'cve':11A,14A 'excelj':1A 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':10A 'hardened':20A 'memori':9A 'spreadsheet':3A 'via':8A","search_b":"'4.4.0':35B 'abort':68B 'alloc':58B 'attribut':39B 'bound':47B 'column':43B,63B 'denial':22B 'denial-of-servic':21B 'element':44B 'error':75B 'excelj':25B,33B 'huge':53B 'hundr':59B 'import':32B 'make':56B 'max':38B,54B 'memori':74B 'million':61B 'node':26B 'nodej':27B 'npm':28B 'object':64B 'out-of-memori':71B 'packag':29B 'process':67B 'servic':24B 'small':49B 'spreadsheet':31B 'spreadsheet-import':30B 'trust':36B 'valu':55B 'without':45B 'workbook':50B 'worksheet':42B 'xlsx.load':57B","search_c":"'4.4.0':78C 'abort':123C 'alloc':115C 'allow':85C 'applic':89C 'attack':86C,101C 'attribut':100C 'caus':112C 'col':94C 'column':120C 'contain':79C 'craft':103C 'crash':88C 'element':95C 'error':134C 'excelj':76C 'exhaust':82C 'heap':129C 'huge':109C 'hundr':116C 'max':99C,110C 'memori':81C,133C 'million':118C 'object':121C 'out-of-memori':130C 'process':125C 'small':105C 'suppli':91C 'unbound':98C 'uncatch':128C 'valu':111C 'vulner':83C 'workbook':106C 'worksheet':93C 'xlsx.load':113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:01:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128338","severity":null,"published_at":"2026-11-13T10:18:14+00:00","modified_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128338:3859","url":"https://github.com/exceljs/exceljs/releases","severity":null,"published_at":"2026-11-13T10:51:12+00:00","modified_at":"2026-11-13T10:51:12+00:00","first_seen_at":"2026-11-13T10:51:12+00:00","fetched_at":"2026-11-13T10:51:12+00:00","note":"GHSA-w57r-3mm6-w6g7 is filed on the exceljs-hardened fork (patched 5.1.0), not upstream; upstream latest release is 4.4.0 with no fix seen. Mitigation: size/zip-bomb limits do not help (6 KB file); isolate parsing in a worker with memory limit. No PoC beyond advisory snippet, no exploitation reported. Not marked verified: upstream fix status is inferred from the releases page.","cites":["https://github.com/exceljs/exceljs/releases"]}],"documents":[{"id":145477,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-w57r-3mm6-w6g7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:01:10+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145478,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-unbounded-worksheet-column-range","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":145526,"url":"https://github.com/exceljs/exceljs/releases","title":"exceljs releases (latest v4.4.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}