CVE-2026-128341

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load iterate billions of...

CVE-2026-128341

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service attack due to a resource exhaustion flaw in data-validations-xform.js. An attacker can supply a small, crafted workbook containing an unbounded sqref range (e.g., A1:XFD1048576). When xlsx.load() processes this fil...

EUVD-2026-125158

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load iterate billions of...