CVE-2021-32013: Denial of Service in SheetsJS Pro
Summary
CVE-2021-32013: Denial of Service in SheetsJS Pro. Affects xlsx versions < 0.17.0. Fixed in 0.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SheetsJS Pro is a popular npm package and Maven dependency used for working with Excel files in JavaScript applications. It provides various functionalities for reading, writing, and manipulating Excel files. However, a vulnerability has been discovered in SheetsJS Pro versions up to 0.16.9 that can lead to a denial of service (DoS) attack when processing a specially crafted .xlsx document. This vulnerability is tracked as CVE-2021-32013 and has a CVSS score of 5.5 (Moderate).
Vulnerability Detail
The vulnerability in SheetsJS Pro arises from a mishandling of a specific type of .xlsx document when read by the xlsx.js module. An attacker can exploit this vulnerability by providing a malicious .xlsx file, causing excessive memory consumption and leading to a DoS condition. This can result in the unavailability of the affected application, impacting its availability and potentially affecting other processes running on the same system. The vulnerability has been assigned a CWE ID of CWE-400.
How To Fix
Latest published version: 0.18.5 as of 22 Oct 2026
npm install xlsx@0.18.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.17.0
This is the first release that contains the fix.
npm install xlsx@0.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can consider implementing input validation and sanitization mechanisms to detect and reject malicious .xlsx files. This can involve checking the file structure, size, and content before processing it with SheetsJS Pro. Additionally, limiting the resources allocated for processing Excel files can help mitigate the impact of a potential DoS attack.
Conclusion
In conclusion, SheetsJS Pro versions up to 0.16.9 are vulnerable to a denial of service (DoS) attack when processing malicious .xlsx files. It is crucial to upgrade to version 0.17.0 or later to mitigate this vulnerability. Implementing input validation and resource limitations can serve as temporary workarounds. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for xlsx →
FAQ
SheetsJS Pro is an npm package and Maven dependency that provides functionality for working with Excel files in JavaScript applications. It allows reading, writing, and manipulating Excel files using JavaScript.
The vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition in applications using vulnerable versions of SheetsJS Pro. This can result in the unavailability of the affected application and potentially impact other processes running on the same system.
To fix this vulnerability, it is recommended to upgrade to SheetsJS Pro version 0.17.0 or later. This version includes a fix for the issue and ensures proper handling of malicious .xlsx files.
As a temporary workaround, developers can implement input validation and sanitization mechanisms to detect and reject malicious .xlsx files. Additionally, limiting the resources allocated for processing Excel files can help mitigate the impact of a potential DoS attack.
Yes, this vulnerability has a CVSS score of 5.5 (Moderate).
Related vulnerabilities
Recent vulnerabilities recorded for xlsx.
