CVE-2026-128343

CVSS 8.7 (high) · published 2026-11-13

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.

Weakness: CWE-606

Source: NVD CVE-2026-128343

References

• https://github.com/exceljs/exceljs
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77
• https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr
• https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.