# CVE-2024-22363: SheetJS Regular Expression Denial of Service

Source: https://junglewise.ai/threats/cve-2024-22363-sheetjs-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-04-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-22363 · Severity: low · CVSS 3.1 · Published 2024-04-05

SheetJS is a popular JavaScript library used for reading, writing, and manipulating spreadsheet files in web applications. Versions before 0.20.2 contain a flaw in how they process certain text patterns using regular expressions. An attacker can send specially crafted input that causes the library to consume excessive CPU resources, making the application slow or completely unresponsive and disrupting service for legitimate users. No authentication is required to exploit this vulnerability.

Technologies: [xlsx (npm)](https://junglewise.ai/threats/technologies/xlsx). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-22363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-22363 being exploited in the wild.

**How severe is CVE-2024-22363?** Low severity, with a CVSS score of 3.1, published 5 April 2024.

**Which products and versions are affected?** xlsx (npm) SEMVER:introduced=0; SheetJS Community Edition < 0.20.2.

**Is there a fix for CVE-2024-22363?** A patch was published on 2024-04-04: Version 0.20.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-22363 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-22363?** Check whether you run xlsx (npm) or SheetJS Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a Regular Expression Denial of Service (ReDoS) attack targeting an inefficient regular expression pattern with nested quantifiers (CWE-1333). The vulnerable regex pattern uses backtracking that can exhibit exponential time complexity when processing certain input strings that fail to match the pattern. Attack vector is network-based with no authentication or user interaction required (CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). An attacker can cause the application to hang or become unresponsive by providing a crafted input string to any function that uses this vulnerable regex. The fix is available in version 0.20.2 and later, which can be obtained from the SheetJS CDN at https://cdn.sheetjs.com/. The npm package xlsx is no longer maintained, but the updated version can be downloaded directly from the CDN.

## Affected products

- SheetJS SheetJS Community Edition < 0.20.2
- SheetJS xlsx (npm package) < 0.20.2

## Identifiers

- CVE-2024-22363
- GHSA-5pgg-2g8v-p4x9

## Timeline

- 2024-04-05: disclosed
- 2024-04-08: advisory: GitHub security advisory reviewed
- 2024-04-04: patched: Version 0.20.2 released with fix

## References

- [https://cdn.sheetjs.com/](https://cdn.sheetjs.com/)
- [https://cdn.sheetjs.com/advisories/CVE-2024-22363](https://cdn.sheetjs.com/advisories/CVE-2024-22363)
- [https://cwe.mitre.org/data/definitions/1333.html](https://cwe.mitre.org/data/definitions/1333.html)
- [https://git.sheetjs.com/sheetjs/sheetjs](https://git.sheetjs.com/sheetjs/sheetjs)
- [https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2](https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2)

## Related threats

- [SheetJS prototype pollution in file parsing](https://junglewise.ai/threats/cve-2023-30533-sheetjs-prototype-pollution-in-file-parsing)
- [SheetJS xlsx denial of service via memory consumption](https://junglewise.ai/threats/cve-2021-32012-sheetjs-xlsx-denial-of-service-via-memory-consumption)
- [SheetJS Pro denial of service via crafted XLSX](https://junglewise.ai/threats/cve-2021-32013-sheetjs-pro-denial-of-service-via-crafted-xlsx)
- [SheetJS Pro denial of service in XLSX parsing](https://junglewise.ai/threats/cve-2021-32014-sheetjs-pro-denial-of-service-in-xlsx-parsing)