CVE-2026-128343

EUVD-2026-125156
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 53.12%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
exceljs_projectexceljs
𝑥
≤ 4.4.0
CNA
Common Weakness Enumeration
References
https://github.com/exceljs/exceljs
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77
https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr
https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number