CVE-2026-105219: Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the npm mammoth package from version 1.3.0 through versions before 1.12.3 are affected. Exposure is relevant where an attacker can cause the application to process a crafted .docx file.
What does an attacker need to provide to trigger the denial of service?
The attacker needs to supply a .docx containing a mammoth/style-map entry with an unterminated quoted string made of repeated backslash escapes. No authentication or user interaction is required according to the supplied vector.
What is the operational impact of successful exploitation?
Processing the crafted document can block the Node.js event loop, causing a denial of service. The provided severity vector indicates availability impact without confidentiality or integrity impact.
How can I determine whether my application is affected?
Check the installed npm/mammoth version and whether the application processes .docx files that could contain attacker-controlled mammoth/style-map data. Versions before 1.12.3 within the affected range should be treated as vulnerable.