---
id: "CVE-2026-128339"
page: "https://infrastack.ai/live/CVE-2026-128339"
kind: "vulnerability"
aliases: ["CVE-2026-128339"]
title: "ExcelJS: crafted workbook exhausts memory and crashes applications parsing it"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "exceljs", "fixed": [], "affected": "<= 4.4.0", "ecosystem": "npm"}, {"name": "exceljs-hardened", "fixed": ["5.1.0"], "affected": "<= 5.0.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["exceljs", "file-upload", "node", "nodejs", "package"]
not_affected_if: ["trusted-input-only", "writes-only-workbooks"]
published_at: "2026-11-13T10:18:14+00:00"
first_seen_at: "2026-11-13T10:47:34+00:00"
updated_at: "2026-11-13T10:51:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128339", "first_seen_at": "2026-11-13T10:47:34+00:00"}, {"source": "analyst", "url": "https://github.com/exceljs/exceljs/issues/3107", "first_seen_at": "2026-11-13T10:51:14+00:00", "cites": ["https://github.com/exceljs/exceljs/issues/3107", "https://github.com/exceljs/exceljs/pull/3114"]}]
exploit_sources: []
---

# ExcelJS: crafted workbook exhausts memory and crashes applications parsing it

Link for people: https://infrastack.ai/live/CVE-2026-128339 (this .md is for agents)

ExcelJS through 4.4.0 fails to bound merged-cell ranges when parsing a spreadsheet, so a small crafted workbook with a huge merge range makes xlsx.load() create billions of objects. An attacker who can supply a spreadsheet to the application can crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:exceljs affected <= 4.4.0 fixed no fixed version listed
- npm:exceljs-hardened affected <= 5.0.2 fixed 5.1.0

## How to check

- Run npm ls exceljs (and npm ls exceljs-hardened) in each project that parses uploaded or external .xlsx files. exceljs <= 4.4.0 is affected; exceljs-hardened <= 5.0.2 is affected.
- Search for xlsx.load( / xlsx.readFile( calls on untrusted input. The abort is a fatal V8 out-of-memory error, so try/catch does not stop it and the whole process dies.

## Fix

No released fix for upstream exceljs (latest 4.4.0 is affected). Fix PR exceljs/exceljs#3114 is open and unmerged. The fork exceljs-hardened is fixed in 5.1.0 (affected <= 5.0.2). Until a release: reject untrusted .xlsx input, or check the zip's xl/worksheets/*.xml for mergeCell refs spanning more than a few thousand cells before calling xlsx.load().

## Timeline

- 2026-11-13T10:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128339
- 2026-11-13T10:51:14+00:00 analyst https://github.com/exceljs/exceljs/issues/3107 — Triage's GHSA link is for the fork exceljs-hardened (fixed 5.1.0), not upstream exceljs. Upstream exceljs: issue #3107 open, fix PR #3114 open/unmerged, no patched release. Not exploited; PoC is in the issue and the advisory.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-wh3v-83h4-rwwq
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-merged-cell-range
- [describes] exceljs #3107: xlsx.load aborts with heap OOM on a large mergeCell range https://github.com/exceljs/exceljs/issues/3107
- [fix] ExcelJS PR #3114: reject oversized merge ranges (different bug, open) https://github.com/exceljs/exceljs/pull/3114

## From the sources

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_