CVE-2026-128339: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using ExcelJS through 4.4.0 are exposed when they load attacker-controlled or otherwise untrusted XLSX workbooks with xlsx.load(). Processing a small malicious workbook can consume enough memory to abort the process.
What must an attacker provide to trigger the denial of service?
An attacker needs to supply a workbook containing an oversized merged-cell range, such as A1:XFD1048576. No authentication, user interaction, or special application configuration is indicated by the available data.
How can I determine whether a workbook is attempting to exploit this issue?
Inspect mergeCell references in incoming workbooks for extremely large ranges. A range spanning from A1 to XFD1048576 is an example that causes Worksheet._parseMergeCells to create billions of Row and Cell objects.