CVE-2026-128342: ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId
ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and writeBuffer for seconds.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial of service?
Applications using ExcelJS through version 4.4.0 are exposed when they process attacker-supplied Excel workbooks. The issue can block the application's event loop during worksheet handling.
What does an attacker need to exploit it?
An attacker needs to supply a workbook whose xl/workbook.xml contains an extremely large worksheet sheetId. No privileges or user interaction are required according to the supplied vector.
Which operations can be affected after processing a malicious workbook?
The sparse worksheet array walk can stall worksheet access through worksheets and getWorksheet, as well as writeBuffer. These operations may block for seconds.