CVE-2026-128342 · Package
NO FIX YET · SEE WHAT TO DO
ExcelJS through 4.4.0 trusts the sheetId value in xl/workbook.xml without a bound. A crafted spreadsheet with a huge sheetId makes worksheet lookups stall the event loop for seconds.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS to read .xlsx files supplied by users or other untrusted sources are exposed, since the crafted sheetId is in the file itself. Apps that only write workbooks they generate, or that never load external files, are less likely to be reached. The sources do not say more.
Not affected if no-untrusted-xlsx-input
Who cares exceljs, node, npm
npm ls exceljsWorkbook.xlsx.load or readFile4.4.0; the sources do not name the fixed versionExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.