EXCELJS · CVE-2026-128343 · Package
FIX → 5.1.0 ✓ verified
exceljs through 4.4.0 parses the row attribute of XLSX files without a bound, so a row numbered far beyond Excel's limit is accepted. Processing such a file makes getSheetValues(), workbook writes and CSV export consume time proportional to that number, blocking the event loop.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Node services that parse XLSX files from users or outside systems with exceljs (<= 4.4.0) or exceljs-hardened (<= 5.0.2). Typical examples are upload, import and report-conversion endpoints. An attacker needs no login if the endpoint is public. The file loads fast, and every later read, write or CSV export blocks the event loop for a time proportional to the row number. Apps that only generate spreadsheets from trusted data can skip it.
Not affected if no-xlsx-parsing, trusted-input-only
Who cares exceljs, exceljs-hardened, node, npm, xlsx-upload
Run npm ls exceljs exceljs-hardened. exceljs <= 4.4.0 is affected, with no upstream fix found. exceljs-hardened <= 5.0.2 is affected, and 5.1.0 is fixed. Then look for code that reads untrusted XLSX through exceljs (wb.xlsx.load/readFile, getSheetValues, xlsx.writeBuffer, csv.writeBuffer). A test file puts <row r="20000000"> in xl/worksheets/sheet1.xml. The advisory reports about 0.6 s for getSheetValues, 1.2 s for an xlsx write and 6.2 s for CSV at that row number, growing linearly.
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 5.1.0
5.1.0 (maintainer advisory)4.4.0 is the latest on its releases page5.1.0