CVE-2026-128343

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128343

The exceljs library versions through 4.4.0 is vulnerable to a Denial of Service (DoS) attack. The root cause is the lack of bounds checking on the row r attributes parsed within row-xform.js . An attacker can craft a malicious XLSX file containing row numbers significantly exceeding Excel's limit...

EUVD-2026-125156

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...