CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...