{"id":"CVE-2026-128344","kind":"vulnerability","aliases":["CVE-2026-128344"],"related":[],"title":"ExcelJS: crafted workbook image anchor exhausts memory and crashes apps","description":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error.","summary":"ExcelJS through 4.4.0 lets a crafted Excel file with an oversized image anchor column make the library allocate millions of column objects. The process aborts with a heap out-of-memory error, crashing the application that reads the file.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"exceljs","fixed":[],"affected":"<= 4.4.0","ecosystem":"npm"},{"name":"exceljs-hardened","fixed":["5.1.0"],"affected":"<= 5.0.2","ecosystem":"npm"}],"ecosystems":[],"tags":["exceljs","file-upload","node","nodejs","npm","package"],"not_affected_if":["generate-only","no-getimages-call","trusted-files-only"],"how_to_check":"- Run npm ls exceljs. Any exceljs version up to 4.4.0 has the flaw, and 4.4.0 is the latest release.\n- If you use the fork, npm ls exceljs-hardened. Versions up to 5.0.2 are affected, and 5.1.0 is patched.\n- Search code for getImages() or image anchor reads (range.tl.col) on workbooks from uploads or external systems.\n- Note the abort is a fatal V8 heap error, so try/catch cannot handle it.","fix":"No fix in upstream exceljs (4.4.0 is the latest release, and I found no upstream advisory or patch). The only patched build is the unofficial fork exceljs-hardened 5.1.0 (npm package exceljs-hardened, not affiliated with the exceljs maintainers). Until upstream patches, do not call getImages() on untrusted workbooks, or reject uploads whose xl/drawings/*.xml has a very large <xdr:col> value.","status":"open","published_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:49:12+00:00","updated_at":"2026-11-13T10:50:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:49:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ExcelJS: crafted workbook image anchor exhausts memory and crashes apps","impact":"low","summary":"ExcelJS through 4.4.0 lets a crafted Excel file with an oversized image anchor column make the library allocate millions of column objects. The process aborts with a heap out-of-memory error, crashing the application that reads the file.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node","nodejs","file-upload"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker crashes the application process with a memory exhaustion error","analyst_note":"Confirm the fixed version and whether the vendor advisory on github.com or the VulnCheck advisory names one.","how_to_check":"- Check the installed version with `npm ls exceljs` in the project.\n- Search lockfiles for `exceljs` and note whether any version is `4.4.0` or earlier.\n- Look for code that calls `getImages()` on workbooks uploaded or received from outside.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-files-only","no-getimages-call","generate-only"],"who_is_affected":"Applications that parse .xlsx files supplied by users or external systems with ExcelJS and call getImages() or read image anchor positions are exposed. Apps that only generate workbooks or only read trusted files are unlikely to be reached. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4644,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the vendor advisory on github.com or the VulnCheck advisory names one.","search":"'-128344':13A,16A '-2026':12A,15A '300000000':105C '4.4.0':31B,71C 'abort':53B,121C 'alloc':46B,115C 'allow':78C 'anchor':5A,41B,91C,101C,111C 'app':10A 'applic':64B,82C 'attack':79C,97C 'column':42B,49B,92C,102C,118C 'contain':72C 'craft':2A,34B 'crash':9A,62B,81C 'cve':11A,14A 'draw':95C 'error':61B,129C 'excel':35B 'excelj':1A,21B,29B,69C 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':6A,75C 'file':23B,36B,68B 'file-upload':22B 'getimag':110C 'hardened':20A 'heap':56B,124C 'imag':4A,40B,90C 'let':32B 'librari':45B 'make':43B,113C 'memori':7A,60B,74C,128C 'million':47B,116C 'node':25B 'nodej':26B 'npm':27B 'object':50B,119C 'out-of-memori':57B,125C 'overs':39B 'packag':28B 'part':96C 'posit':112C 'process':52B 'read':66B,109C 'set':99C 'suppli':84C 'unbound':89C 'upload':24B 'vulner':76C 'workbook':3A,86C 'worksheet.getcolumn':114C 'xl/drawings/drawing1.xml':107C","nicknames":[],"mitigations":[],"who_affected":"Node.js services that parse .xlsx files from users or outside systems with exceljs up to 4.4.0 and then read image positions with getImages(). One small file can abort the whole process, and try/catch cannot stop it. Apps that only generate workbooks, never call getImages(), or only read trusted files can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["exceljs","exceljshardened"],"ptokens":["exceljs","hardened"],"labels":["exceljs","fileupload","high","node","nodejs","npm","package"],"campaign_type":null,"search_a":"'-128344':13A,16A '-2026':12A,15A 'anchor':5A 'app':10A 'craft':2A 'crash':9A 'cve':11A,14A 'excelj':1A 'exceljs':17A,19A 'exceljs-hardened':18A 'exhaust':6A 'hardened':20A 'imag':4A 'memori':7A 'workbook':3A","search_b":"'4.4.0':31B 'abort':53B 'alloc':46B 'anchor':41B 'applic':64B 'column':42B,49B 'craft':34B 'crash':62B 'error':61B 'excel':35B 'excelj':21B,29B 'file':23B,36B,68B 'file-upload':22B 'heap':56B 'imag':40B 'let':32B 'librari':45B 'make':43B 'memori':60B 'million':47B 'node':25B 'nodej':26B 'npm':27B 'object':50B 'out-of-memori':57B 'overs':39B 'packag':28B 'process':52B 'read':66B 'upload':24B","search_c":"'300000000':105C '4.4.0':71C 'abort':121C 'alloc':115C 'allow':78C 'anchor':91C,101C,111C 'applic':82C 'attack':79C,97C 'column':92C,102C,118C 'contain':72C 'crash':81C 'draw':95C 'error':129C 'excelj':69C 'exhaust':75C 'getimag':110C 'heap':124C 'imag':90C 'make':113C 'memori':74C,128C 'million':116C 'object':119C 'out-of-memori':125C 'part':96C 'posit':112C 'read':109C 'set':99C 'suppli':84C 'unbound':89C 'vulner':76C 'workbook':86C 'worksheet.getcolumn':114C 'xl/drawings/drawing1.xml':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:05:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128344","severity":null,"published_at":"2026-11-13T10:18:14+00:00","modified_at":"2026-11-13T10:18:14+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-128344:3854","url":null,"severity":null,"published_at":"2026-11-13T10:50:01+00:00","modified_at":"2026-11-13T10:50:01+00:00","first_seen_at":"2026-11-13T10:50:01+00:00","fetched_at":"2026-11-13T10:50:01+00:00","note":"VulnCheck: exceljs <=4.4.0, no fixed version. The GHSA is on the unofficial fork mateocallec/exceljs-hardened (affected <=5.0.2, patched 5.1.0), not on upstream. Upstream appears unmaintained and has no fix. The advisory includes a PoC (300000000 anchor col, heap OOM); no exploitation reported. Nothing marked verified because there is no upstream vendor source."}],"documents":[{"id":145489,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:05:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145490,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}