CVE-2026-128346: ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files
ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml to fill the temporary directory and exhaust file descriptors.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that use ExcelJS streaming WorkbookReader.parse to process attacker-supplied workbook uploads are exposed. The described attack relies on repeatedly submitting malformed multi-sheet workbooks.
What does an attacker need to do to exploit it?
An attacker needs network access to an upload or processing path that parses workbooks with the streaming reader. No authentication or user interaction is required according to the supplied vector.
What is the operational impact?
Failed parsing or early iteration can leave temporary files and file descriptors open. Repeated requests can fill the temporary directory and exhaust file descriptors, causing denial of service.
How can I determine whether an application is affected?
Check whether the application uses ExcelJS version 4.4.0 or earlier and calls the streaming WorkbookReader.parse method on untrusted workbooks. Monitor for accumulating temporary files and increasing open file descriptors after malformed workbook parsing failures or early termination.