CVE-2026-128345

Name of the Vulnerable Software and Affected Versions ExcelJS versions prior to 4.4.1

Description A regular expression denial of service occurs in the slideFormula function within lib/utils/shared-formula.js during the translation of shared formulas to child cells. An attacker can provide a specially crafted spreadsheet containing very long master formulas, such as repeated sequences of hyphens, which triggers quadratic regex backtracking. This process blocks the Node.js event loop, leading to a denial of service.

Recommendations Update to version 4.4.1 or later.