CVE-2026-128341
Received Received - Intake

ExcelJS Resource Exhaustion via Unbounded Sqref Ranges

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128341
EUVD
EUVD-2026-125158

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
exceljs exceljs From 0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ExcelJS through version 4.4.0 has a vulnerability where attackers can cause resource exhaustion by providing unbounded sqref ranges in a workbook. This leads to excessive CPU and memory usage, blocking the event loop and crashing the process with an uncatchable out-of-memory error.

Detection Guidance

This vulnerability can be detected by checking if ExcelJS versions prior to 4.4.1 are installed. Inspect package.json or run npm list exceljs to verify the version. If the version is 4.4.0 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability can cause system crashes, denial of service, and potential downtime for applications using ExcelJS. It may also lead to resource exhaustion on servers or systems processing malicious files.

Mitigation Strategies

Immediately update ExcelJS to version 4.4.1 or later. If updating is not possible, consider removing ExcelJS from the system or restricting its use to trusted inputs only. Monitor system resources for unusual CPU or memory spikes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128341. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...