CVE-2026-128343: ExcelJS through 4.4.0 Denial of Service via Oversized Row Number
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the denial of service?
An attacker needs to supply a crafted XLSX file containing a row r attribute set to a value far beyond Excel's normal row limit. No authentication or user interaction is required according to the supplied CVSS vector.
Which application operations can be affected after processing a malicious workbook?
The issue can cause event-loop blocking when the application calls getSheetValues(), writes the workbook, or exports it as CSV. Processing time grows in proportion to the attacker-controlled row number.
Who is exposed to this issue?
Applications using ExcelJS through 4.4.0 that parse or otherwise process XLSX files from untrusted sources are exposed. Services that perform workbook reads, writes, or CSV export may become unavailable while handling a crafted file.