CVE-2026-128345

EUVD-2026-125154
ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic regex backtracking that blocks the Node.js event loop.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 44.99%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
exceljs_projectexceljs
𝑥
≤ 4.4.0
CNA
Common Weakness Enumeration
References
https://github.com/exceljs/exceljs
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/shared-formula.js#L4-L12
https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pr65-54q8-vhqm
https://www.vulncheck.com/advisories/exceljs-through-4.4.0-redos-via-slideformula-shared-formula-translation