{"id":"CVE-2026-128345","kind":"vulnerability","aliases":["CVE-2026-128345"],"related":[],"title":"ExcelJS: crafted spreadsheet formulas can freeze Node.js servers","description":"ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop.","summary":"ExcelJS through 4.4.0 has a regular expression flaw in its shared formula handling that backtracks heavily on long formulas. A crafted spreadsheet can block the Node.js event loop and stall the process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node.js","npm","package"],"not_affected_if":["no-untrusted-xlsx-input"],"how_to_check":"- Check the installed ExcelJS version with `npm ls exceljs`\n- Look for ExcelJS reading uploaded or untrusted .xlsx files in your code","fix":null,"status":"open","published_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:54:30+00:00","updated_at":"2026-11-13T10:54:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:54:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ExcelJS: crafted spreadsheet formulas can freeze Node.js servers","impact":"low","summary":"ExcelJS through 4.4.0 has a regular expression flaw in its shared formula handling that backtracks heavily on long formulas. A crafted spreadsheet can block the Node.js event loop and stall the process.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node.js","npm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server process stalls while parsing a crafted spreadsheet, causing denial of service","analyst_note":"Confirm the fixed ExcelJS version and whether the vendor advisory on github.com names one; the sources here do not state it.","how_to_check":"- Check the installed ExcelJS version with `npm ls exceljs`\n- Look for ExcelJS reading uploaded or untrusted .xlsx files in your code\n- unknown for a fixed version: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx-input"],"who_is_affected":"Applications that use ExcelJS to parse spreadsheets supplied by users or other untrusted sources are exposed, because a crafted file reaches the vulnerable shared formula code. Projects that only generate spreadsheets from trusted data, or never read untrusted files, can skip it. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000748,"input_tokens":4616,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128345':11A,14A '-2026':10A,13A '4.4.0':21B,53C 'attack':73C 'backtrack':33B,92C 'block':42B,94C 'caus':89C 'cell':72C 'child':71C 'contain':54C 'craft':2A,39B,77C 'cve':9A,12A 'denial':58C 'event':45B,97C 'excelj':1A,15B,19B,51C 'express':25B,57C 'flaw':26B 'formula':4A,30B,37B,69C,83C 'freez':6A 'handl':31B 'heavili':34B 'hyphen':88C 'lib/utils/shared-formula.js':65C 'long':36B,81C 'loop':46B,98C 'master':82C 'node.js':7A,16B,44B,96C 'npm':17B 'packag':18B 'process':50B 'quadrat':90C 'regex':91C 'regular':24B,56C 'run':86C 'server':8A 'servic':60C 'share':29B,68C 'slideformula':63C 'spreadsheet':3A,40B,78C 'stall':48B 'suppli':75C 'translat':67C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS to parse spreadsheets supplied by users or other untrusted sources are exposed, because a crafted file reaches the vulnerable shared formula code. Projects that only generate spreadsheets from trusted data, or never read untrusted files, can skip it. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","medium","nodejs","npm","package"],"campaign_type":null,"search_a":"'-128345':11A,14A '-2026':10A,13A 'craft':2A 'cve':9A,12A 'excelj':1A 'formula':4A 'freez':6A 'node.js':7A 'server':8A 'spreadsheet':3A","search_b":"'4.4.0':21B 'backtrack':33B 'block':42B 'craft':39B 'event':45B 'excelj':15B,19B 'express':25B 'flaw':26B 'formula':30B,37B 'handl':31B 'heavili':34B 'long':36B 'loop':46B 'node.js':16B,44B 'npm':17B 'packag':18B 'process':50B 'regular':24B 'share':29B 'spreadsheet':40B 'stall':48B","search_c":"'4.4.0':53C 'attack':73C 'backtrack':92C 'block':94C 'caus':89C 'cell':72C 'child':71C 'contain':54C 'craft':77C 'denial':58C 'event':97C 'excelj':51C 'express':57C 'formula':69C,83C 'hyphen':88C 'lib/utils/shared-formula.js':65C 'long':81C 'loop':98C 'master':82C 'node.js':96C 'quadrat':90C 'regex':91C 'regular':56C 'run':86C 'servic':60C 'share':68C 'slideformula':63C 'spreadsheet':78C 'suppli':75C 'translat':67C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:03:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128345","severity":null,"published_at":"2026-11-13T10:18:15+00:00","modified_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145491,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pr65-54q8-vhqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:03:03+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145492,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-redos-via-slideformula-shared-formula-translation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}