CVE-2026-128345

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128343

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...

EUVD-2026-125156

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128345

ExcelJS versions through 4.4.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the slideFormula function located in lib/utils/shared-formula.js. The root cause is triggered during the translation of shared formulas to child cells, where a crafted spreadsheet containing very lo...

CVE-2026-127056

PapaParse before 5.7.1 contains an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service by submitting delimiter-free quoted CSV input to Papa.parse. Attackers can supply a single-column quoted CSV with no delimiters, triggering...

gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLS_E_AGAIN / GNUTLS_E_INTERRUPTED)

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results GNUTLSEAGAIN and GNUTLSEINTERRUPTED are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC...

K000164198: Brace-expansion vulnerability CVE-2026-69152

Security Advisory Description The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing...

source-map-js: source-map-js: Denial of Service via malformed indexed source maps

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it...

python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields

A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service DoS for all connections. The vulnerability occurs...

python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields

A flaw was found in Tornado. An unauthenticated remote attacker could send a specially crafted request with a large number of fields in the URL-encoded body. This could cause the single-threaded event loop to stall, leading to a Denial of Service DoS for all connections. The vulnerability occurs...

CVE-2026-125333

A flaw was found in node-forge. A remote attacker operating a malicious server or positioned on the network path can cause a Denial of Service DoS by returning an HTTP response containing specially crafted headers or cookie values with excessive whitespace. When the HTTP client module trims...

GHSA-6CV4-P8M7-4R25 Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forg...

Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forg...

CVE-2026-124016

postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine function by crafting deeply nested multipart email messages with boundary lines sharing long...

CVE-2026-124016

The postal-mime library before version 4.2.1 is vulnerable to an algorithmic complexity denial of service (DoS) via the PostalMime.processLine() function. Unauthenticated remote attackers can cause excessive CPU consumption by delivering crafted emails with deeply nested multipart structures (up ...

CVE-2026-124016 postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine

postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine function by crafting deeply nested multipart email messages with boundary lines sharing long...

CVE-2026-125333

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...