CVE-2026-128338: ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range
exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() to allocate hundreds of millions of Column objects and abort the process with an uncatchable heap out-of-memory error.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using ExcelJS through 4.4.0 are exposed when they load attacker-controlled XLSX workbooks with xlsx.load(). The vulnerable input is a worksheet col element whose max attribute is set to an extremely large value.
What does an attacker need to exploit it?
An attacker only needs to supply a crafted workbook; no privileges or user interaction are required. A small workbook can specify a huge max value and trigger allocation of hundreds of millions of Column objects.
What is the impact if exploitation succeeds?
The affected process can abort with an uncatchable heap out-of-memory error. This produces a denial of service through memory exhaustion.
How can I identify a suspicious workbook?
Inspect worksheet col elements for an unbounded or unusually large max attribute. Such a value can cause ExcelJS to create an excessive number of Column objects during xlsx.load().