{"id":"CVE-2026-128340","kind":"vulnerability","aliases":["CVE-2026-128340"],"related":[],"title":"ExcelJS: crafted workbook exhausts memory and crashes apps on load","description":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().","summary":"ExcelJS through 4.4.0 expands defined-name ranges such as S!$A$1:$XFD$1048576 cell by cell during xlsx.load(). A workbook of about 6 KB makes Node abort with a fatal heap out-of-memory error that try/catch cannot handle. The maintainer's advisory covers the exceljs-hardened fork (fixed in 5.1.0). I found no fixed upstream exceljs release.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"exceljs","fixed":[],"affected":"<= 4.4.0","ecosystem":"npm"},{"name":"exceljs-hardened","fixed":["5.1.0"],"affected":"<= 5.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["dos","exceljs","exceljs-hardened","node.js","nodejs","npm","package"],"not_affected_if":["no-xlsx-upload","trusted-input-only"],"how_to_check":"- Run npm ls exceljs; versions <= 4.4.0 are affected. Also run npm ls exceljs-hardened; versions <= 5.0.2 are affected, 5.1.0 is fixed.\n- Search code for xlsx.load( , xlsx.read( and readFile( on user-supplied files.\n- Test: an xlsx whose xl/workbook.xml has <definedName name=\"x\">S!$A$1:$XFD$1048576</definedName> crashes the process with a fatal heap OOM, which try/catch cannot stop.","fix":"exceljs (upstream): no fixed release found; 4.4.0 and earlier affected, status unknown. exceljs-hardened fork: upgrade to 5.1.0 (maintainer advisory). Until then, reject or size-limit untrusted xlsx before xlsx.load(), and parse in a separate worker process with --max-old-space-size set so a crash does not take down the app.","status":"open","published_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:49:19+00:00","updated_at":"2026-11-13T10:51:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:49:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ExcelJS: crafted workbook exhausts memory and crashes apps on load","impact":"medium","summary":"ExcelJS through 4.4.0 expands oversized defined-name ranges in an xlsx workbook cell by cell while loading. A crafted file makes the process run out of heap memory during xlsx.load(), and the error cannot be caught, so the application crashes.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node.js","nodejs"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Application process crashes from uncatchable heap exhaustion on load","analyst_note":"Confirm the fixed version and any patch from the NVD entry or the vendor advisory linked in the sources.","how_to_check":"- Check the installed version with `npm ls exceljs` and see whether it is `4.4.0` or earlier.\n- Search code for `xlsx.load(` or `workbook.xlsx.load` on data from users or external sources.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","no-xlsx-upload"],"who_is_affected":"Applications that parse xlsx files supplied by users or other untrusted sources with ExcelJS through 4.4.0 are exposed, since a workbook with an oversized defined-name range triggers the memory exhaustion during xlsx.load(). Applications that only process trusted spreadsheets they generate themselves are unlikely to be reached.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4632,"output_tokens":567,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any patch from the NVD entry or the vendor advisory linked in the sources.","search":"'-128340':13A,16A '-2026':12A,15A '1':42B,124C '1048576':44B,126C '4.4.0':32B,94C '5.1.0':84B '6':54B 'abort':58B 'advisori':75B 'allow':101C 'app':8A 'applic':105C 'attack':102C 'cannot':70B 'caus':132C 'cell':45B,47B,129C,131C 'contain':95C 'cover':76B 'craft':2A 'crash':7A,104C 'cve':11A,14A 'defin':35B,114C 'defined-nam':34B,113C 'definednames.addex':117C 'dos':21B 'error':67B,141C 'excelj':1A,22B,24B,30B,79B,90B,92C 'exceljs':17A,19A 'exceljs-harden':23B,78B 'exceljs-hardened':18A 'exhaust':4A,98C 'expand':33B,118C 'fatal':61B,135C 'fix':82B,88B 'fork':81B 'found':86B 'handl':71B 'harden':25B,80B 'hardened':20A 'heap':62B,136C 'kb':55B 'load':10A 'maintain':73B 'make':56B 'memori':5A,66B,97C,140C 'name':36B,115C 'node':57B 'node.js':26B 'nodej':27B 'npm':28B 'out-of-memori':63B,137C 'overs':112C 'packag':29B 'rang':37B,116C,119C 'releas':91B 'suppli':107C 'try/catch':69B 'uncatch':134C 'upstream':89B 'vulner':99C 'workbook':3A,51B,109C 'xfd':43B,125C 'xl/workbook.xml':128C 'xlsx.load':49B,143C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse xlsx files supplied by users or other untrusted sources with ExcelJS through 4.4.0 are exposed, since a workbook with an oversized defined-name range triggers the memory exhaustion during xlsx.load(). Applications that only process trusted spreadsheets they generate themselves are unlikely to be reached.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["exceljs","exceljshardened"],"ptokens":["exceljs","hardened"],"labels":["dos","exceljs","exceljshardened","high","nodejs","npm","package"],"campaign_type":null,"search_a":"'-128340':13A,16A '-2026':12A,15A 'app':8A 'craft':2A 'crash':7A 'cve':11A,14A 'excelj':1A 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':4A 'hardened':20A 'load':10A 'memori':5A 'workbook':3A","search_b":"'1':42B '1048576':44B '4.4.0':32B '5.1.0':84B '6':54B 'abort':58B 'advisori':75B 'cannot':70B 'cell':45B,47B 'cover':76B 'defin':35B 'defined-nam':34B 'dos':21B 'error':67B 'excelj':22B,24B,30B,79B,90B 'exceljs-harden':23B,78B 'expand':33B 'fatal':61B 'fix':82B,88B 'fork':81B 'found':86B 'handl':71B 'harden':25B,80B 'heap':62B 'kb':55B 'maintain':73B 'make':56B 'memori':66B 'name':36B 'node':57B 'node.js':26B 'nodej':27B 'npm':28B 'out-of-memori':63B 'packag':29B 'rang':37B 'releas':91B 'try/catch':69B 'upstream':89B 'workbook':51B 'xfd':43B 'xlsx.load':49B","search_c":"'1':124C '1048576':126C '4.4.0':94C 'allow':101C 'applic':105C 'attack':102C 'caus':132C 'cell':129C,131C 'contain':95C 'crash':104C 'defin':114C 'defined-nam':113C 'definednames.addex':117C 'error':141C 'excelj':92C 'exhaust':98C 'expand':118C 'fatal':135C 'heap':136C 'memori':97C,140C 'name':115C 'out-of-memori':137C 'overs':112C 'rang':116C,119C 'suppli':107C 'uncatch':134C 'vulner':99C 'workbook':109C 'xfd':125C 'xl/workbook.xml':128C 'xlsx.load':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:02:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128340","severity":null,"published_at":"2026-11-13T10:18:14+00:00","modified_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128340:3857","url":"https://github.com/exceljs/exceljs/issues/1898","severity":null,"published_at":"2026-11-13T10:51:12+00:00","modified_at":"2026-11-13T10:51:12+00:00","first_seen_at":"2026-11-13T10:51:12+00:00","fetched_at":"2026-11-13T10:51:12+00:00","note":"GHSA-qvh4-wwpm-ggc8 is published on the exceljs-hardened fork (npm, <=5.0.2, fixed 5.1.0), not upstream exceljs. No upstream exceljs fix for the defined-name bug found: 4.4.0 is the affected range. Upstream issue #1898 (same root cause, 2021) was closed without a fix I could see. Open PR #3114 covers mergeCells, a different bug. Nothing verified because I found no upstream vendor page.","cites":["https://github.com/exceljs/exceljs/issues/1898"]}],"documents":[{"id":145481,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:02:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145482,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":145525,"url":"https://github.com/exceljs/exceljs/issues/1898","title":"ExcelJS #1898: heap overflow due to Defined Names (closed)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}