CVE-2021-32014: Oracle Rest Data Services

Medium severity, CVSS 5.5. EPSS: 0.9% chance of exploitation in the next 30 days.

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.

Affected products

• Oracle Rest Data Services: before 21.2.4 (fixed in 21.2.4)
• Sheetjs Sheetjs: up to and including 0.16.9
• Sheetjs Sheetjs Pro: up to and including 0.16.9

Published 2021-07-19. Last modified 2026-06-17.