CVE-2026-105219 in mammoth.js
Summary
by MITRE • 10/04/2026
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The Mammoth library, specifically versions prior to 1.12.3 including version 1.3.0, contains a critical regular expression denial of service vulnerability within its style map tokeniser located in lib/styles/parser/tokeniser.js. This flaw stems from the presence of overlapping regex alternatives that fail to handle certain malformed inputs efficiently. When an attacker supplies a crafted .docx file containing specific patterns designed to exploit this weakness, they can trigger catastrophic backtracking during the regular expression matching process. The core issue involves unterminated quoted strings composed of repeated backslash escapes within the mammoth/style-map component. Because Node.js operates on a single-threaded event loop model, such computationally intensive regex operations block the execution thread entirely. This prevents the application from processing any other requests or tasks until the operation completes or times out, effectively causing a denial of service for all users interacting with the affected system.
From a technical perspective, this vulnerability is classified under CWE-1335 as Regular Expression Denial of Service (ReDoS). The mechanism relies on ambiguous regex patterns where multiple alternatives can match parts of the input string in different ways. When the engine encounters an input that nearly matches but ultimately fails due to specific boundary conditions like unterminated strings, it exhaustively tries all possible combinations before concluding failure. In this case, the repeated backslash escapes create a scenario with exponential time complexity relative to the length of the input. This behavior allows remote attackers to consume excessive CPU resources by simply submitting maliciously formatted documents through any interface that utilizes Mammoth for parsing Word files into HTML or other formats.
The operational impact of this vulnerability is severe in environments where document processing is performed synchronously or without adequate resource limits. Applications relying on Mammoth.js to convert .docx files are particularly susceptible, as the attack vector requires only a single crafted file upload or input submission. Once triggered, the Node.js event loop becomes unresponsive, leading to application hangs and potential crashes if not mitigated by external monitoring tools. This can result in significant downtime for web services that depend on document conversion features, affecting availability and potentially causing data loss if processes are forcibly terminated. The vulnerability highlights the risks associated with using third-party libraries without rigorous input validation or regex optimization safeguards.
To mitigate this risk, organizations should immediately upgrade Mammoth.js to version 1.12.3 or later, where these overlapping alternatives have been resolved. For systems that cannot be updated instantly, implementing a Web Application Firewall rule to detect and block requests containing suspiciously long sequences of backslashes in document uploads can provide temporary protection. Additionally, developers should enforce strict input validation on file contents before passing them to the parser and consider running document processing tasks in isolated worker threads with CPU time limits to prevent blocking the main event loop. Monitoring for high CPU usage spikes associated with regex operations can also aid in early detection of such attacks. This incident underscores the importance of maintaining up-to-date dependencies and validating input data against known attack patterns defined by industry standards like CWE-1335 and ATT&CK techniques related to resource exhaustion.