CVE-2026-128342

Name of the Vulnerable Software and Affected Versions ExcelJS versions prior to 4.4.1

Description A denial of service issue exists where attackers can block the event loop by providing an unbounded sheetId within the xl/workbook.xml file. By supplying an excessively large sheetId, the sparse worksheet array walk causes the worksheets, getWorksheet(), and writeBuffer() functions to stall for several seconds.

Recommendations Update to version 4.4.1 or later.