{"id":"CVE-2026-128343","aliases":["GHSA-3gm5-qxj8-89rr"],"url":"https://o3.security/vulnerability/CVE-2026-128343","summary":"ExcelJS through 4.4.0 Denial of Service via Oversized Row Number","details":"exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.","published":"2026-11-13T09:33:33.699Z","modified":"2026-11-14T10:30:39.203797591Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128343.json"},{"type":"PACKAGE","url":"https://github.com/exceljs/exceljs"},{"type":"ARTICLE","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580"},{"type":"ARTICLE","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893"},{"type":"ARTICLE","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77"},{"type":"ADVISORY","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128343"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-14T10:30:39.203797591Z"}}