CVE-2026-128346

Name of the Vulnerable Software and Affected Versions ExcelJS versions prior to 4.4.1

Description A resource leak exists in the streaming WorkbookReader.parse() function. When sheet parsing fails or iteration is stopped prematurely, temporary files and open descriptors are not properly closed. This can be exploited by uploading malformed multi-sheet workbooks where worksheets are positioned before xl/sharedStrings.xml, leading to the exhaustion of file descriptors and filling the temporary directory.

Recommendations Update to version 4.4.1 or later.