CVE-2026-128339 | ExcelJS up to 4.4.0 Merge Cell Parsing Worksheet._parseMergeCells memory allocation

November 13, 2026 Yanac

A vulnerability was found in ExcelJS up to 4.4.0. It has been classified as problematic. This issue affects the function Worksheet._parseMergeCells of the component Merge Cell Parsing. Performing a manipulation results in uncontrolled memory allocation.

This vulnerability is identified as CVE-2026-128339. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More