CVE-2026-128340
Received Received - Intake

Memory Exhaustion in ExcelJS via Oversized Defined-Name Range

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128340
EUVD
EUVD-2026-125037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
exceljs exceljs From 0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ExcelJS through version 4.4.0 has a memory exhaustion vulnerability where attackers can crash applications by providing a workbook with an excessively large defined-name range. The DefinedNames.addEx function processes ranges like S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, leading to an uncatchable fatal heap out-of-memory error during xlsx.load().

Impact Analysis

This vulnerability can cause applications using ExcelJS to crash due to memory exhaustion, potentially leading to denial-of-service conditions. It may disrupt workflows, corrupt data, or require application restarts.

Mitigation Strategies

Update ExcelJS to version 4.4.1 or later to address the memory exhaustion issue in DefinedNames.addEx. Avoid processing untrusted Excel files with oversized defined-name ranges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128340. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...