CVE-2026-128339

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128338

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load to allocate hundreds of millions of Colu...

CVE-2026-128340

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128337

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

EUVD-2026-125040

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

CVE-2026-128337

Versions of ExcelJS through 4.4.0 are vulnerable to a prototype pollution vulnerability in the mergeConditionalFormattings function. An attacker can exploit this by supplying an x14:cfRule id of __proto__. By crafting a malicious .xlsx file and loading it via xlsx.load(), an attacker can modify O...

CVE-2026-128338

The exceljs library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue. An attacker can crash applications by providing a worksheet col element containing an unbounded max attribute . When processing such a workbook, the xlsx.load() function attempts to allocate hundreds of milli...

EUVD-2026-125038

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128339

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue within the Worksheet._parseMergeCells function. An attacker can crash an application by providing a workbook containing an unbounded mergeCell range , such as A1:XFD1048576. When xlsx.load() processes this fil...

EUVD-2026-125037

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128341

The ExcelJS library (versions through 4.4.0 ) is vulnerable to a Denial of Service attack due to a resource exhaustion flaw in data-validations-xform.js. An attacker can supply a small, crafted workbook containing an unbounded sqref range (e.g., A1:XFD1048576). When xlsx.load() processes this fil...

CVE-2026-128340

The ExcelJS library, versions through 4.4.0 , is vulnerable to a memory exhaustion flaw. The issue resides in the DefinedNames.addEx function, which processes oversized defined-name ranges from xl/workbook.xml (e.g., S!$A$1:$XFD$1048576) by expanding them cell by cell. This behavior triggers an u...