{"id":"CVE-2026-128341","aliases":["GHSA-f689-fh93-2pm2"],"url":"https://o3.security/vulnerability/CVE-2026-128341","summary":"ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref","details":"ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load() iterate billions of addresses, blocking the event loop and crashing the process with an uncatchable out-of-memory error.","published":"2026-11-13T09:33:35.085Z","modified":"2026-11-14T02:47:33.922278371Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128341.json"},{"type":"PACKAGE","url":"https://github.com/exceljs/exceljs"},{"type":"ARTICLE","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/data-validations-xform.js#L216-L227"},{"type":"REPORT","url":"https://github.com/exceljs/exceljs/issues/3093"},{"type":"ADVISORY","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f689-fh93-2pm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128341"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-data-validation-sqref"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T02:47:33.922278371Z"}}