{"id":"CVE-2026-128341","kind":"vulnerability","aliases":["CVE-2026-128341"],"related":[],"title":"ExcelJS: crafted workbook exhausts CPU and memory, crashing Node processes","description":"ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.","summary":"ExcelJS through 4.4.0 parses unbounded sqref ranges in data-validations-xform.js without limits. A small crafted .xlsx file makes xlsx.load() iterate billions of cell addresses, blocking the event loop and crashing the process with an out-of-memory error.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"exceljs","fixed":[],"affected":"<= 4.4.0","ecosystem":"npm"},{"name":"exceljs-hardened","fixed":["5.1.0"],"affected":"<= 5.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["exceljs","exceljs-hardened","javascript","node","npm","package"],"not_affected_if":["export-only","no-untrusted-xlsx-input"],"how_to_check":"- Run `npm ls exceljs`; exceljs <= 4.4.0 is affected per VulnCheck (4.4.0 reproduced in exceljs issue #3093).\n- If you use the fork, run `npm ls exceljs-hardened`; versions <= 5.0.2 are affected, 5.1.0 fixes it.\n- Find calls to `workbook.xlsx.load()` or `readFile()` on files from uploads, email or other outside sources.","fix":"No fixed release of upstream exceljs found (latest 4.4.0). The unofficial fork exceljs-hardened fixes it in 5.1.0 (<= 5.0.2 affected). Until upstream ships a fix, reject untrusted .xlsx input or pre-check sheet XML dataValidation sqref sizes before calling load().","status":"open","published_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:49:17+00:00","updated_at":"2026-11-13T10:51:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:49:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ExcelJS: crafted workbook exhausts CPU and memory, crashing Node processes","impact":"medium","summary":"ExcelJS through 4.4.0 parses unbounded sqref ranges in data-validations-xform.js without limits. A small crafted .xlsx file makes xlsx.load() iterate billions of cell addresses, blocking the event loop and crashing the process with an out-of-memory error.","audience":"developers","category":"package","nicknames":[],"who_cares":["node","exceljs","javascript"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Node process crashes and stops serving requests from a small file","analyst_note":"Confirm the first fixed ExcelJS version and the vendor advisory at github.com before writing the fix field.","how_to_check":"- Check the installed version with `npm ls exceljs`.\n- Search lockfiles and manifests for `exceljs` and note any version at or below `4.4.0`.\n- Look for code that calls `xlsx.load()` or `workbook.xlsx.load()` on files uploaded or received from users.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx-input","export-only"],"who_is_affected":"Applications that use ExcelJS to parse .xlsx files supplied by outside users, such as upload endpoints, import jobs or mail processors, are exposed. Projects that only generate workbooks or only read trusted local files are less exposed. The sources do not say which version fixes it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4646,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the first fixed ExcelJS version and the vendor advisory at github.com before writing the fix field.","search":"'-128341':13A,16A '-2026':12A,15A '4.4.0':31B,69C 'a1':101C 'address':51B,109C 'allow':78C 'attack':79C,90C 'billion':48B,107C 'block':52B,110C 'cell':50B 'contain':70C 'cpu':5A,82C 'craft':2A,42B,95C 'crash':8A,57B,115C 'cve':11A,14A 'data-validations-xform.js':37B,76C 'error':66B,125C 'event':54B,112C 'excelj':1A,21B,23B,29B,67C 'exceljs':17A,19A 'exceljs-harden':22B 'exceljs-hardened':18A 'exhaust':4A,73C,81C 'file':44B 'harden':24B 'hardened':20A 'iter':47B,106C 'javascript':25B 'limit':39B 'loop':55B,113C 'make':45B,104C 'memori':7A,65B,84C,124C 'node':9A,26B 'npm':27B 'out-of-memori':62B,121C 'packag':28B 'pars':32B 'process':10A,59B,117C 'provid':92C 'rang':35B,89C 'resourc':72C 'small':41B,94C 'sqref':34B,88C,99C 'suppli':86C 'unbound':33B,87C 'uncatch':120C 'vulner':74C 'without':38B 'workbook':3A,96C 'xfd1048576':102C 'xlsx':43B 'xlsx.load':46B,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse .xlsx files from outside users with exceljs (<= 4.4.0) or the unofficial exceljs-hardened fork (<= 5.0.2), such as upload endpoints, import jobs or mail processors, are exposed. One small file can block the Node event loop and end the process with an out-of-memory abort that try/catch cannot handle. Apps that only write workbooks or read trusted files can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["exceljs","exceljshardened"],"ptokens":["exceljs","hardened"],"labels":["exceljs","exceljshardened","high","javascript","node","npm","package"],"campaign_type":null,"search_a":"'-128341':13A,16A '-2026':12A,15A 'cpu':5A 'craft':2A 'crash':8A 'cve':11A,14A 'excelj':1A 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':4A 'hardened':20A 'memori':7A 'node':9A 'process':10A 'workbook':3A","search_b":"'4.4.0':31B 'address':51B 'billion':48B 'block':52B 'cell':50B 'craft':42B 'crash':57B 'data-validations-xform.js':37B 'error':66B 'event':54B 'excelj':21B,23B,29B 'exceljs-harden':22B 'file':44B 'harden':24B 'iter':47B 'javascript':25B 'limit':39B 'loop':55B 'make':45B 'memori':65B 'node':26B 'npm':27B 'out-of-memori':62B 'packag':28B 'pars':32B 'process':59B 'rang':35B 'small':41B 'sqref':34B 'unbound':33B 'without':38B 'xlsx':43B 'xlsx.load':46B","search_c":"'4.4.0':69C 'a1':101C 'address':109C 'allow':78C 'attack':79C,90C 'billion':107C 'block':110C 'contain':70C 'cpu':82C 'craft':95C 'crash':115C 'data-validations-xform.js':76C 'error':125C 'event':112C 'excelj':67C 'exhaust':73C,81C 'iter':106C 'loop':113C 'make':104C 'memori':84C,124C 'out-of-memori':121C 'process':117C 'provid':92C 'rang':89C 'resourc':72C 'small':94C 'sqref':88C,99C 'suppli':86C 'unbound':87C 'uncatch':120C 'vulner':74C 'workbook':96C 'xfd1048576':102C 'xlsx.load':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:01:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128341","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128341","severity":null,"published_at":"2026-11-13T10:18:14+00:00","modified_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128341:3856","url":null,"severity":null,"published_at":"2026-11-13T10:51:10+00:00","modified_at":"2026-11-13T10:51:10+00:00","first_seen_at":"2026-11-13T10:51:10+00:00","fetched_at":"2026-11-13T10:51:10+00:00","note":"GHSA-f689-fh93-2pm2 is published in the third-party fork exceljs-hardened (affected <=5.0.2, patched 5.1.0), not by upstream exceljs. Upstream exceljs 4.4.0 reproduced in issue #3093 (open, PRs #3096/#3103 referenced; no merged fix or release seen). No upstream fixed version found, so fix left unconfirmed and nothing marked verified."}],"documents":[{"id":145483,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f689-fh93-2pm2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:01:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145484,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-data-validation-sqref","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":145524,"url":"https://github.com/exceljs/exceljs/issues/3093","title":"exceljs#3093: crafted dataValidation sqref causes unbounded CPU/memory (DoS)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}