CVE-2026-128339

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue within the Worksheet._parseMergeCells function. An attacker can crash an application by providing a workbook containing an unbounded mergeCell range , such as A1:XFD1048576. When xlsx.load() processes this fil...

EUVD-2026-125038

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128340 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128341

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service attack due to a resource exhaustion flaw in data-validations-xform.js. An attacker can supply a small, crafted workbook containing an unbounded sqref range (e.g., A1:XFD1048576). When xlsx.load() processes this fil...

EUVD-2026-125158

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load iterate billions of...

EUVD-2026-125037

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128340

The ExcelJS library, versions through 4.4.0 , is vulnerable to a memory exhaustion flaw. The issue resides in the DefinedNames.addEx function, which processes oversized defined-name ranges from xl/workbook.xml (e.g., S!$A$1:$XFD$1048576) by expanding them cell by cell. This behavior triggers an u...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...

CVE-2026-128343

The exceljs library versions through 4.4.0 is vulnerable to a Denial of Service (DoS) attack. The root cause is the lack of bounds checking on the row r attributes parsed within row-xform.js . An attacker can craft a malicious XLSX file containing row numbers significantly exceeding Excel's limit...

CVE-2026-128344

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion (CWE-770) flaw. An attacker can crash applications by providing a workbook containing an unbounded image anchor column within the drawing part (e.g., setting an anchor column like 300000000 in xl/drawings/drawing1.x...

CVE-2026-128344 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Image Anchor Column

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

EUVD-2026-125155

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

EUVD-2026-125156

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128345

ExcelJS versions through 4.4.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the slideFormula function located in lib/utils/shared-formula.js. The root cause is triggered during the translation of shared formulas to child cells, where a crafted spreadsheet containing very lo...

EUVD-2026-125154

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128346

Versions of ExcelJS up to and including 4.4.0 are vulnerable to a resource leak in the streaming WorkbookReader.parse function. The root cause is the failure to properly clean up temporary files and open descriptors when parsing a sheet fails or iteration stops prematurely. An attacker can exploi...

EUVD-2026-125152

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any fi...

EUVD-2026-125153

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

CVE-2026-128347

Versions of ExcelJS through 4.4.0 are vulnerable to an arbitrary file read vulnerability within the streaming WorkbookWriter component. The root cause is the lack of proper sanitization when processing image filenames in the addImage function. An attacker can inject ../ path segments into user-co...