{"id":"CVE-2026-128342","kind":"vulnerability","aliases":["CVE-2026-128342"],"related":[],"title":"ExcelJS: crafted workbook sheetId stalls the Node event loop","description":"ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds.","summary":"ExcelJS through 4.4.0 trusts the sheetId value in xl/workbook.xml without a bound. A crafted spreadsheet with a huge sheetId makes worksheet lookups stall the event loop for seconds.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node","npm","package"],"not_affected_if":["no-untrusted-xlsx-input"],"how_to_check":"- Check the installed version with `npm ls exceljs`\n- Find where the app parses uploaded or untrusted .xlsx files with ExcelJS, such as `Workbook.xlsx.load` or `readFile`","fix":"- Move to a release newer than `4.4.0`; the sources do not name the fixed version","status":"open","published_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:49:16+00:00","updated_at":"2026-11-13T10:49:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:49:16Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a release newer than `4.4.0`; the sources do not name the fixed version","reach":"internet","title":"ExcelJS: crafted workbook sheetId stalls the Node event loop","impact":"low","summary":"ExcelJS through 4.4.0 trusts the sheetId value in xl/workbook.xml without a bound. A crafted spreadsheet with a huge sheetId makes worksheet lookups stall the event loop for seconds.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node","npm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Event loop blocked for seconds, causing service slowdown or denial of service","analyst_note":"Confirm the fixed version and the exact affected code path; check the GitHub advisory and VulnCheck pages linked in the signal.","how_to_check":"- Check the installed version with `npm ls exceljs`\n- Find where the app parses uploaded or untrusted .xlsx files with ExcelJS, such as `Workbook.xlsx.load` or `readFile`\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx-input"],"who_is_affected":"Applications that use ExcelJS to read .xlsx files supplied by users or other untrusted sources are exposed, since the crafted sheetId is in the file itself. Apps that only write workbooks they generate, or that never load external files, are less likely to be reached. The sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4613,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128342':12A,15A '-2026':11A,14A '4.4.0':22B,50C 'allow':58C 'array':85C 'attack':59C,72C 'block':61C 'bound':31B 'contain':51C 'craft':2A,33B 'cve':10A,13A 'denial':53C 'event':8A,44B,63C 'excelj':1A,16B,20B,48C 'getworksheet':89C 'huge':37B,79C 'lookup':41B 'loop':9A,45B,64C 'make':39B,81C 'node':7A,17B 'npm':18B 'packag':19B 'provid':74C 'second':47B,93C 'servic':55C 'sheetid':4A,25B,38B,69C,80C 'spars':83C 'spreadsheet':34B 'stall':5A,42B,87C 'suppli':66C 'trust':23B 'unbound':68C 'valu':26B 'vulner':56C 'walk':86C 'without':29B 'workbook':3A,76C 'worksheet':40B,84C,88C 'writebuff':91C 'xl/workbook.xml':28B,71C","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS to read .xlsx files supplied by users or other untrusted sources are exposed, since the crafted sheetId is in the file itself. Apps that only write workbooks they generate, or that never load external files, are less likely to be reached. The sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","high","node","npm","package"],"campaign_type":null,"search_a":"'-128342':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'event':8A 'excelj':1A 'loop':9A 'node':7A 'sheetid':4A 'stall':5A 'workbook':3A","search_b":"'4.4.0':22B 'bound':31B 'craft':33B 'event':44B 'excelj':16B,20B 'huge':37B 'lookup':41B 'loop':45B 'make':39B 'node':17B 'npm':18B 'packag':19B 'second':47B 'sheetid':25B,38B 'spreadsheet':34B 'stall':42B 'trust':23B 'valu':26B 'without':29B 'worksheet':40B 'xl/workbook.xml':28B","search_c":"'4.4.0':50C 'allow':58C 'array':85C 'attack':59C,72C 'block':61C 'contain':51C 'denial':53C 'event':63C 'excelj':48C 'getworksheet':89C 'huge':79C 'loop':64C 'make':81C 'provid':74C 'second':93C 'servic':55C 'sheetid':69C,80C 'spars':83C 'stall':87C 'suppli':66C 'unbound':68C 'vulner':56C 'walk':86C 'workbook':76C 'worksheet':84C,88C 'writebuff':91C 'xl/workbook.xml':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:05:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128342","severity":null,"published_at":"2026-11-13T10:18:14+00:00","modified_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null}],"documents":[{"id":145485,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9vv6-5g3h-prg5","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:05:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145486,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-worksheet-sheetid","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}