CVE-2026-128345: ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation
ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using ExcelJS through 4.4.0 are exposed when they process attacker-supplied spreadsheets that contain shared formulas. The impact is a Node.js event-loop block, resulting in reduced availability.
What does an attacker need to exploit it?
An attacker needs to provide a crafted spreadsheet containing a very long master formula, such as a formula with long runs of hyphens. No privileges or user interaction are required according to the supplied vector.
How can I tell whether my application is affected?
Check whether the application uses ExcelJS version 4.4.0 or earlier and translates shared formulas while reading or processing untrusted spreadsheets. Affected processing may become unresponsive when handling files with unusually long shared master formulas.