EXCELJS · CVE-2026-128344 · Package
FIX → 5.1.0
ExcelJS through 4.4.0 lets a crafted Excel file with an oversized image anchor column make the library allocate millions of column objects. The process aborts with a heap out-of-memory error, crashing the application that reads the file.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Node.js services that parse .xlsx files from users or outside systems with exceljs up to 4.4.0 and then read image positions with getImages(). One small file can abort the whole process, and try/catch cannot stop it. Apps that only generate workbooks, never call getImages(), or only read trusted files can skip it.
Not affected if generate-only, no-getimages-call, trusted-files-only
Who cares exceljs, file-upload, node, nodejs, npm
Upgrade to 5.1.0
4.4.0 is the latest release, and I found no upstream advisory or patch)ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
5.1.0 (npm package exceljs-hardened, not affiliated with the exceljs maintainers)