EXCELJS · CVE-2026-128340 · Package
FIX → 5.1.0
ExcelJS through 4.4.0 expands defined-name ranges such as S!$A$1:$XFD$1048576 cell by cell during xlsx.load(). A workbook of about 6 KB makes Node abort with a fatal heap out-of-memory error that try/catch cannot handle. The maintainer's advisory covers the exceljs-hardened fork (fixed in 5.1.0). I found no fixed upstream exceljs release.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that parse xlsx files supplied by users or other untrusted sources with ExcelJS through 4.4.0 are exposed, since a workbook with an oversized defined-name range triggers the memory exhaustion during xlsx.load(). Applications that only process trusted spreadsheets they generate themselves are unlikely to be reached.
Not affected if no-xlsx-upload, trusted-input-only
Who cares dos, exceljs, exceljs-hardened, node.js, nodejs, npm
Upgrade to 5.1.0
4.4.0 and earlier affected, status unknown. exceljs-hardened fork: upgrade to (maintainer advisory)ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
5.1.0NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.