Medium severity · published Jul 19, 2021
CVE-2021-32012
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js…
5.5
CVSS
0.9%
EPSS
No
On KEV
Description
SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RD
Rest Data Services · Oracle
before 21.2.4 · source: NVD
SH
Sheetjs · Sheetjs Project
through 0.16.9 · source: NVD
SP
Sheetjs Pro · Sheetjs Project
through 0.16.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32012
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32012
Third Party Advisory
https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/
Product
https://sheetjs.com/pro
Product
https://www.npmjs.com/package/xlsx/v/0.17.0
Patch
https://www.oracle.com/security-alerts/cpujan2022.html
More from Rest Data Services
6.1
CVE-2020-11023
Potential XSS vulnerability in jQuery
10.0
CVE-2026-46840
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service)
9.9
CVE-2026-46839
Vulnerability in Oracle REST Data Services (component: Core)
9.9
CVE-2026-46775
Vulnerability in Oracle REST Data Services (component: Core)
9.8
CVE-2017-7658
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…