CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128340

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128336

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

CVE-2026-128336

The ExcelJS library (through version 4.4.0 ) is vulnerable to a prototype pollution vulnerability. An attacker can supply a crafted xlsx file where the xl/workbook.xml definedName range targets proto . When workbook.xlsx.load() is executed, the CellMatrix component writes empty arrays onto Object...

EUVD-2026-125041

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

EUVD-2026-125037

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128340

The ExcelJS library, versions through 4.4.0 , is vulnerable to a memory exhaustion flaw. The issue resides in the DefinedNames.addEx function, which processes oversized defined-name ranges from xl/workbook.xml (e.g., S!$A$1:$XFD$1048576) by expanding them cell by cell. This behavior triggers an u...

EUVD-2026-125157

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128342

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service (DoS) attack due to an unchecked input for loop conditions (CWE-606 ). An attacker can provide a workbook containing a large, unbounded sheetId in the xl/workbook.xml file. This causes the sparse worksheet array wa...