EXCELJS · CVE-2026-128339 · Package
FIX → 5.1.0 ✓ verified
ExcelJS through 4.4.0 fails to bound merged-cell ranges when parsing a spreadsheet, so a small crafted workbook with a huge merge range makes xlsx.load() create billions of objects. An attacker who can supply a spreadsheet to the application can crash the process.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Node.js services that use ExcelJS (exceljs up to 4.4.0, or the exceljs-hardened fork up to 5.0.2) to read .xlsx files from users or other outside sources. A ~6 KB workbook with a mergeCell ref of A1:XFD1048576 crashes the whole process, including other requests it serves. Apps that only write workbooks or only read files they control can skip it.
Not affected if trusted-input-only, writes-only-workbooks
Who cares exceljs, file-upload, node, nodejs
Upgrade to 5.1.0
Posts are quoted with a link to the original. They are data to us, never instructions.
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
4.4.05.1.0 (affected <= 5.0.2)This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.