CVE-2026-128346

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

CVE-2026-128346

Versions of ExcelJS up to and including 4.4.0 are vulnerable to a resource leak in the streaming WorkbookReader.parse function. The root cause is the failure to properly clean up temporary files and open descriptors when parsing a sheet fails or iteration stops prematurely. An attacker can exploi...

EUVD-2026-125153

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...