Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105219Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

High 7.5

In plain English

A high-severity regular-expression denial of service in mammoth.js from mwilliamson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.

Affected products (as reported)

Vendor	Product	Versions
mwilliamson	mammoth.js	1.3.0 – before 1.12.3

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Issue #487 issue-tracking
https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4 patch
https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30 technical-description
https://github.com/mwilliamson/mammoth.js product
VulnCheck Advisory: Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser third-party-advisory