Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-105219: Mammoth.js allows crafted .docx to freeze server
CVE-2026-105219 · published 14 days ago
Summary
Mammoth.js versions before 1.12.3 can be tricked by a specially crafted Word document that contains a malformed style map. This can cause the server running Node.js to become unresponsive, potentially disrupting service. Update to version 1.12.3 or later to stop the problem.
What to do
- Update mwilliamson mammoth.js to version 1.12.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mwilliamson | mammoth.js | < 1.12.3 |
Original advisory text
Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.
References
- https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386...
- https://github.com/mwilliamson/mammoth.js/issues/487
- https://www.vulncheck.com/advisories/mammoth-js-1.3.0-before-1.12.3-redos-via-st...
- https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokenise...
- https://github.com/mwilliamson/mammoth.js
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105219 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.7
High
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published4 Oct 2026
Updated15 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta