EXCELJS · CVE-2026-128346 · Package
FIX → 5.1.0
ExcelJS up to 4.4.0 leaves temporary files and open file descriptors behind when streaming WorkbookReader.parse fails or iteration stops early. Repeated uploads of crafted multi-sheet workbooks can fill the temp directory and exhaust descriptors (DoS). The GitHub advisory is published on the fork exceljs-hardened (fixed in 5.1.0); no fix for upstream exceljs was found.
first public Oct 16, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Node apps that parse user-uploaded workbooks with ExcelJS's streaming WorkbookReader in a long-running process (<= 4.4.0), and users of the exceljs-hardened fork <= 5.0.2. Projects that only write workbooks, use the non-streaming reader, or parse trusted files can skip it.
Not affected if no-streaming-reader, no-untrusted-uploads, write-only-usage
Who cares exceljs, exceljs-hardened, file-upload, node, npm, streaming-reader
Run npm ls exceljs exceljs-hardened. Exposed if exceljs <= 4.4.0 (or exceljs-hardened <= 5.0.2) AND code uses new ExcelJS.stream.xlsx.WorkbookReader(...) (grep for WorkbookReader) on untrusted uploads in a long-running process. Symptom: many tmp-* files accumulating in os.tmpdir() and EMFILE errors.
Upgrade to 5.1.0
ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
4.4.0 and the upstream issue exceljs/exceljs#2147 is open. exceljs-hardened (a fork): upgrade to 5.1.0 per its advisoryNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.