CVE-2026-128341: ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref
ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications that call xlsx.load() on workbooks supplied by an attacker are exposed. The crafted workbook can cause CPU and memory exhaustion while it is loaded.
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted workbook containing an oversized data-validation sqref range. The supplied CVSS vector indicates exploitation is network-reachable, requires no privileges or user interaction, and has low attack complexity.
What symptoms would indicate exploitation or attempted exploitation?
Loading the workbook may cause the Node.js event loop to block as ExcelJS iterates through an extremely large number of cell addresses. The process can then crash with an uncatchable out-of-memory error.
Is a large uploaded file required for exploitation?
No. The issue can be triggered by a small crafted workbook whose sqref is A1:XFD1048576.