---
id: "CVE-2026-128346"
page: "https://infrastack.ai/live/CVE-2026-128346"
kind: "vulnerability"
aliases: ["CVE-2026-128346"]
title: "ExcelJS: streaming workbook parser leaks temp files and file descriptors"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "exceljs", "fixed": [], "affected": "<= 4.4.0", "ecosystem": "npm"}, {"name": "exceljs-hardened", "fixed": ["5.1.0"], "affected": "<= 5.0.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["exceljs", "exceljs-hardened", "file-upload", "node", "npm", "package", "streaming-reader"]
not_affected_if: ["no-streaming-reader", "no-untrusted-uploads", "write-only-usage"]
published_at: "2026-11-13T10:18:15+00:00"
first_seen_at: "2026-11-13T10:47:35+00:00"
updated_at: "2026-11-13T10:50:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128346", "first_seen_at": "2026-11-13T10:47:35+00:00"}, {"source": "analyst", "url": "https://github.com/exceljs/exceljs/issues/2147", "first_seen_at": "2026-11-13T10:50:01+00:00", "cites": ["https://github.com/exceljs/exceljs/issues/2147"]}]
exploit_sources: []
---

# ExcelJS: streaming workbook parser leaks temp files and file descriptors

Link for people: https://infrastack.ai/live/CVE-2026-128346 (this .md is for agents)

ExcelJS up to 4.4.0 leaves temporary files and open file descriptors behind when streaming WorkbookReader.parse fails or iteration stops early. Repeated uploads of crafted multi-sheet workbooks can fill the temp directory and exhaust descriptors (DoS). The GitHub advisory is published on the fork exceljs-hardened (fixed in 5.1.0); no fix for upstream exceljs was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:exceljs affected <= 4.4.0 fixed no fixed version listed
- npm:exceljs-hardened affected <= 5.0.2 fixed 5.1.0

## How to check

Run `npm ls exceljs exceljs-hardened`. Exposed if exceljs <= 4.4.0 (or exceljs-hardened <= 5.0.2) AND code uses `new ExcelJS.stream.xlsx.WorkbookReader(...)` (grep for WorkbookReader) on untrusted uploads in a long-running process. Symptom: many tmp-* files accumulating in os.tmpdir() and EMFILE errors.

## Fix

exceljs: no fixed release found; latest is 4.4.0 and the upstream issue exceljs/exceljs#2147 is open. exceljs-hardened (a fork): upgrade to 5.1.0 per its advisory. Interim: avoid the streaming WorkbookReader for untrusted files, cap upload size/rate, and clean stale tmp files / restart workers.

## Timeline

- 2026-11-13T10:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128346
- 2026-11-13T10:50:01+00:00 analyst https://github.com/exceljs/exceljs/issues/2147 — GHSA-mp7v-gxhv-42h2 is on the exceljs-hardened fork (affected <=5.0.2, patched 5.1.0), not upstream exceljs; VulnCheck lists exceljs<=4.4.0. Upstream issue #2147 still open, no upstream fix found. Nothing verified: the GHSA is for a different package than the CVE's. Not exploited; PoC is in the GHSA text.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-mp7v-gxhv-42h2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/exceljs-through-4.4.0-resource-exhaustion-via-streaming-workbookreader-temporary-files
- [mentions] exceljs #2147: WorkbookReader.parse() doesn't cleanup temporary files if not fully iterated (open) https://github.com/exceljs/exceljs/issues/2147

## From the sources

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_