CVE-2026-128345 · Package
NO FIX YET
ExcelJS through 4.4.0 has a regular expression flaw in its shared formula handling that backtracks heavily on long formulas. A crafted spreadsheet can block the Node.js event loop and stall the process.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS to parse spreadsheets supplied by users or other untrusted sources are exposed, because a crafted file reaches the vulnerable shared formula code. Projects that only generate spreadsheets from trusted data, or never read untrusted files, can skip it. The sources do not name a fixed version.
Not affected if no-untrusted-xlsx-input
Who cares exceljs, node.js, npm
npm ls exceljsNo fix yet, per the sources.
ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.