CVE-2026-105219: Mammoth.js Regular Expression DoS Vulnerability

CVE-2026-105219 Overview

CVE-2026-105219 is a regular expression denial of service (ReDoS) vulnerability in Mammoth.js, a popular Node.js library that converts .docx documents to HTML. Versions 1.3.0 through 1.12.2 contain a vulnerable regex in the style map tokeniser located at lib/styles/parser/tokeniser.js. The regex uses overlapping alternatives that trigger catastrophic backtracking when parsing an unterminated quoted string containing many backslash escape sequences. An attacker who can supply a crafted document or a malicious mammoth/style-map entry can block the Node.js event loop, denying service to the host application.

Critical Impact
A single crafted .docx file can stall the Node.js event loop, suspending all concurrent requests served by the process.

Affected Products

Mammoth.js versions 1.3.0 through 1.12.2
Node.js applications that convert untrusted .docx input through Mammoth.js
Web services and document pipelines embedding Mammoth.js for DOCX-to-HTML conversion

Discovery Timeline

2026-10-04 - CVE-2026-105219 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105219

Vulnerability Analysis

Mammoth.js tokenises style map strings using a regular expression that captures quoted literals. The string prefix regex, defined as '((?:\\.|[^'])*), allows the alternatives \\. and [^'] to match the same backslash character. When the tokeniser encounters a quoted string that lacks a closing quote and contains repeated backslashes, the regex engine explores an exponential number of ways to partition those backslashes between the two alternatives. This drives CPU utilization to 100% on the single-threaded event loop and prevents the Node.js process from handling any other work.

The weakness is classified under CWE-1333: Inefficient Regular Expression Complexity. Because Mammoth.js is widely embedded in server-side upload handlers and content ingestion pipelines, exploitation can disrupt entire multi-tenant services even though the vulnerability targets only availability.

Root Cause

The root cause is overlapping regex alternatives in lib/styles/parser/tokeniser.js. The pattern (?:\\.|[^'])* is ambiguous: a backslash can be consumed by either branch, producing exponential backtracking paths when the terminator never appears. The maintainers rewrote the pattern to anchor the escape alternative to either any character or end-of-input, and to exclude the backslash from the fallback character class, eliminating ambiguity.

Attack Vector

Exploitation is remote and unauthenticated. An attacker uploads or submits a .docx document whose embedded style map contains an unterminated single-quoted literal filled with repeating \\ escape sequences. When the server-side Mammoth.js call parses the style map, the regex engine enters catastrophic backtracking and blocks the event loop until the process is killed or restarted.

The following patch, from commit dc49225425c2c07de0a6dc3529f2386c82a032b4, shows the fix shipped in version 1.12.3:

javascript

 exports.tokenise = tokenise;
 
-var stringPrefix = "'((?:\\\\.|[^'])*)";
+var stringPrefix = "'((?:\\\\(?:.|$)|[^'\\\\])*)";
 
 function tokenise(string) {
     var identifierCharacter = "(?:[a-zA-Z\\-_]|\\\\.)";

Source: Mammoth.js patch commit

Detection Methods for CVE-2026-105219

Indicators of Compromise

Node.js worker processes pinned at 100% CPU while handling document uploads or style-map configuration reloads
HTTP request timeouts clustered around endpoints that invoke mammoth.convertToHtml() or mammoth.extractRawText()
.docx uploads containing style map strings with long sequences of backslashes and no closing single quote

Detection Strategies

Run npm ls mammoth and npm audit across build pipelines to flag any Mammoth.js version below 1.12.3
Instrument the Node.js event loop with perf_hooks or event-loop-lag metrics and alert on sustained delays above a baseline threshold
Inspect .docx payloads at the ingress boundary for oversized or malformed mammoth/style-map custom XML parts before passing them to the parser

Monitoring Recommendations

Capture per-request CPU time for document-conversion endpoints and alert when a single request exceeds a defined ceiling
Log the size and byte distribution of style-map parts extracted from uploaded documents
Track process restart rates and worker crashes in container orchestration metrics for services that embed Mammoth.js

How to Mitigate CVE-2026-105219

Immediate Actions Required

Upgrade Mammoth.js to version 1.12.3 or later in all production, staging, and build environments
Audit dependency lockfiles and transitive dependencies to confirm no vulnerable copy of Mammoth.js remains
Enforce request-level and per-document CPU timeouts on any service that converts untrusted .docx input

Patch Information

The fix is included in Mammoth.js 1.12.3. The maintainer's release note states: "Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service." See the upstream commit, issue 487, and the VulnCheck advisory for details. The maintainer still recommends processing untrusted documents in a separate thread with a timeout.

Workarounds

Isolate document conversion in a worker thread or child process with a hard wall-clock timeout, so a stalled parse can be terminated without impacting the main event loop
Reject uploads whose size, structure, or style-map content deviates from expected norms before invoking Mammoth.js
Rate-limit document-conversion endpoints and require authentication to reduce the exposure of unauthenticated callers

bash

# Upgrade Mammoth.js to the patched release
npm install mammoth@^1.12.3
npm ls mammoth