CVE-2026-128339
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.