EXCELJS · CVE-2026-128341 · Package
FIX → 5.1.0
ExcelJS through 4.4.0 parses unbounded sqref ranges in data-validations-xform.js without limits. A small crafted .xlsx file makes xlsx.load() iterate billions of cell addresses, blocking the event loop and crashing the process with an out-of-memory error.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that parse .xlsx files from outside users with exceljs (<= 4.4.0) or the unofficial exceljs-hardened fork (<= 5.0.2), such as upload endpoints, import jobs or mail processors, are exposed. One small file can block the Node event loop and end the process with an out-of-memory abort that try/catch cannot handle. Apps that only write workbooks or read trusted files can skip it.
Not affected if export-only, no-untrusted-xlsx-input
Who cares exceljs, exceljs-hardened, javascript, node, npm
npm ls exceljs; exceljs <= 4.4.0 is affected per VulnCheck (4.4.0 reproduced in exceljs issue #3093).npm ls exceljs-hardened; versions <= 5.0.2 are affected, 5.1.0 fixes it.workbook.xlsx.load() or readFile() on files from uploads, email or other outside sources.Posts are quoted with a link to the original. They are data to us, never instructions.
ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 5.1.0
4.4.0)5.1.0 (<= 5.0.2 affected)