CVE-2026-128339

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

EUVD-2026-125038

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128339

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue within the Worksheet._parseMergeCells function. An attacker can crash an application by providing a workbook containing an unbounded mergeCell range , such as A1:XFD1048576. When xlsx.load() processes this fil...