CVE-2026-105219

HIGH 7.5

Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.

CWE	CWE-1333
Vendor	mwilliamson
Product	mammoth.js
Published	Oct 4, 2026

Stay Ahead of the Next One

Get instant alerts for mwilliamson mammoth.js

Be the first to know when new high vulnerabilities affecting mwilliamson mammoth.js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

mwilliamson / mammoth.js

1.3.0 < 1.12.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mwilliamson/mammoth.js/issues/487 github.com: https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4 github.com: https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30 github.com: https://github.com/mwilliamson/mammoth.js vulncheck.com: https://www.vulncheck.com/advisories/mammoth-js-1.3.0-before-1.12.3-redos-via-style-map-tokeniser

Credits

Siyang Wu