CVE-2026-105219: Mwilliamson Mammoth.js

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.

Affected products

• Mwilliamson Mammoth.js: from 1.3.0, before 1.12.3 (fixed in 1.12.3)

Published 2026-10-04. Last modified 2026-10-06.