{"id":"CVE-2026-105219","published":"2026-10-04T18:16:34.777","lastModified":"2026-10-06T16:00:36.547","description":"Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mwilliamson/mammoth.js","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/issues/487","tags":[]},{"url":"https://www.vulncheck.com/advisories/mammoth-js-1.3.0-before-1.12.3-redos-via-style-map-tokeniser","tags":[]}],"exploitRefs":[{"url":"https://github.com/mwilliamson/mammoth.js","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4","tags":[]},{"url":"https://github.com/mwilliamson/mammoth.js/issues/487","tags":[]}],"hasPoc":true,"ai":{"summary":"Mammoth.js is vulnerable to a regular expression denial of service (ReDoS) attack that can block the Node.js event loop when processing crafted .docx files with unterminated quoted strings containing repeated backslash escapes in style maps, potentially causing a denial of service for all users of the application.","exploitability":"Exploitation is relatively straightforward as attackers only need to upload a specially crafted .docx file with an unterminated quoted string of repeated backslash escapes in the mammoth/style-map section, requiring no user interaction or authentication.","blast_radius":"The impact could be significant across all users of applications using Mammoth.js for .docx processing, potentially leading to widespread service unavailability if the vulnerability is exploited in a document processing pipeline.","remediation":"Upgrade to Mammoth.js version 1.12.3 or later to address the ReDoS vulnerability in the style map tokeniser.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["redos","document-processing","dos","office-documents","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:57:19.126Z"}}