CVE-2026-128338

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load to allocate hundreds of millions of Colu...

EUVD-2026-125039

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load to allocate hundreds of millions of Colu...

CVE-2026-128338

The exceljs library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue. An attacker can crash applications by providing a worksheet col element containing an unbounded max attribute . When processing such a workbook, the xlsx.load() function attempts to allocate hundreds of milli...