MEDIUM5.5

GHSA-g973-978j-2c3p

Denial of Service in SheetJS Pro

Quick fix

GHSA-g973-978j-2c3p — xlsx: upgrade to the fixed version with the command below.

npm install xlsx@0.17.0

Details

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/xlsx

Introduced in: 0Fixed in: 0.17.0

Fixnpm install xlsx@0.17.0

Maven/org.webjars.npm:xlsx

Introduced in: 0Fixed in: 0.17.0

Fix# pom.xml: bump <version>0.17.0</version> for org.webjars.npm:xlsx

References

https://nvd.nist.gov/vuln/detail/CVE-2021-32014[ADVISORY]
https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely[WEB]
https://sheetjs.com/pro[WEB]
https://www.npmjs.com/package/xlsx/v/0.17.0[WEB]
https://www.oracle.com/security-alerts/cpujan2022.html[WEB]