CVE-2026-128340

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

EUVD-2026-125037

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128340

The ExcelJS library, versions through 4.4.0 , is vulnerable to a memory exhaustion flaw. The issue resides in the DefinedNames.addEx function, which processes oversized defined-name ranges from xl/workbook.xml (e.g., S!$A$1:$XFD$1048576) by expanding them cell by cell. This behavior triggers an u...