---
id: "CVE-2026-128340"
page: "https://infrastack.ai/live/CVE-2026-128340"
kind: "vulnerability"
aliases: ["CVE-2026-128340"]
title: "ExcelJS: crafted workbook exhausts memory and crashes apps on load"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "exceljs", "fixed": [], "affected": "<= 4.4.0", "ecosystem": "npm"}, {"name": "exceljs-hardened", "fixed": ["5.1.0"], "affected": "<= 5.0.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["dos", "exceljs", "exceljs-hardened", "node.js", "nodejs", "npm", "package"]
not_affected_if: ["no-xlsx-upload", "trusted-input-only"]
published_at: "2026-11-13T10:18:14+00:00"
first_seen_at: "2026-11-13T10:47:34+00:00"
updated_at: "2026-11-13T10:51:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128340", "first_seen_at": "2026-11-13T10:47:34+00:00"}, {"source": "analyst", "url": "https://github.com/exceljs/exceljs/issues/1898", "first_seen_at": "2026-11-13T10:51:12+00:00", "cites": ["https://github.com/exceljs/exceljs/issues/1898"]}]
exploit_sources: []
---

# ExcelJS: crafted workbook exhausts memory and crashes apps on load

Link for people: https://infrastack.ai/live/CVE-2026-128340 (this .md is for agents)

ExcelJS through 4.4.0 expands defined-name ranges such as S!$A$1:$XFD$1048576 cell by cell during xlsx.load(). A workbook of about 6 KB makes Node abort with a fatal heap out-of-memory error that try/catch cannot handle. The maintainer's advisory covers the exceljs-hardened fork (fixed in 5.1.0). I found no fixed upstream exceljs release.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:exceljs affected <= 4.4.0 fixed no fixed version listed
- npm:exceljs-hardened affected <= 5.0.2 fixed 5.1.0

## How to check

- Run npm ls exceljs; versions <= 4.4.0 are affected. Also run npm ls exceljs-hardened; versions <= 5.0.2 are affected, 5.1.0 is fixed.
- Search code for xlsx.load( , xlsx.read( and readFile( on user-supplied files.
- Test: an xlsx whose xl/workbook.xml has <definedName name="x">S!$A$1:$XFD$1048576</definedName> crashes the process with a fatal heap OOM, which try/catch cannot stop.

## Fix

exceljs (upstream): no fixed release found; 4.4.0 and earlier affected, status unknown. exceljs-hardened fork: upgrade to 5.1.0 (maintainer advisory). Until then, reject or size-limit untrusted xlsx before xlsx.load(), and parse in a separate worker process with --max-old-space-size set so a crash does not take down the app.

## Timeline

- 2026-11-13T10:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128340
- 2026-11-13T10:51:12+00:00 analyst https://github.com/exceljs/exceljs/issues/1898 — GHSA-qvh4-wwpm-ggc8 is published on the exceljs-hardened fork (npm, <=5.0.2, fixed 5.1.0), not upstream exceljs. No upstream exceljs fix for the defined-name bug found: 4.4.0 is the affected range. Upstream issue #1898 (same root cause, 2021) was closed without a fix I could see. Open PR #3114 covers mergeCells, a different bug. Nothing verified because I found no upstream vendor page.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range
- [mentions] ExcelJS #1898: heap overflow due to Defined Names (closed) https://github.com/exceljs/exceljs/issues/1898

## From the sources

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_