High priorityDisclosed

Advisory · CVE-2026-105219

A crafted docx can hang mammoth.js with regex backtracking

mammoth.js's style-map tokeniser has overlapping regex alternatives that an attacker can exploit with a crafted .docx, blocking the Node.js event loop in a regular-expression denial of service.

Advisory published October 4, 2026Independent summary
Vendor
mwilliamson
Product
mammoth.js
Identifier / CWE
CVE-2026-105219
CWE-1333
Action timing
Immediate
ELI5

Explain it like I’m five

mammoth.js reads Word documents using a pattern matcher that can get stuck going in circles on a specially made input, like a maze with no exit. One bad document keeps the whole program frozen, and every other user waiting on it is stuck too.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted document uploaded

    The attacker supplies a .docx containing an unterminated quoted string of repeated backslash escapes in the style map.

  2. 02Tokeniser engaged

    mammoth.js parses the style map with the tokeniser in lib/styles/parser/tokeniser.js.

  3. 03Regex backtracking

    Overlapping regex alternatives cause catastrophic backtracking on the crafted input.

  4. 04Event loop blocked

    The Node.js event loop is blocked, denying service to all concurrent requests.

What happened

mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js, caused by overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in the style map to block the Node.js event loop. It is rated high at CVSS 8.7 under CVSS v4.0 (7.5 under v3.1) and tracked as CWE-1333.

What to do

  1. Upgrade mammoth to 1.12.3 or later.
  2. If document conversion accepts untrusted uploads, treat this as remotely triggerable: prioritize the upgrade on any upload-facing service.
  3. Consider timeouts and worker isolation for document conversion so a single bad file cannot take down the whole process.
  4. Review for abnormal CPU spikes or hung conversion jobs that could indicate probing.

Management note

ReDoS is the quiet availability killer: no data stolen, no logs screaming, just a single uploaded file that freezes your service. mammoth.js is a popular docx-to-HTML converter often wired directly to upload endpoints, which makes this remotely triggerable for many deployments. The fix is a patch bump, and it is worth adding conversion timeouts while you are at it.