CVE-2026-97151: mammoth.js Prototype Pollution Vulnerability

CVE-2026-97151 Overview

CVE-2026-97151 is a prototype pollution vulnerability in mammoth (also known as mammoth.js), a popular Node.js library that converts Microsoft Word .docx documents into HTML. Versions prior to 1.12.2 fail to safely handle style definitions parsed from document XML, allowing a crafted .docx file to inject arbitrary properties onto Object.prototype. In versions 1.11.0 through 1.12.1, the pollution can be chained to flip the internal externalFileAccess flag to true, enabling disclosure of local server files during subsequent document conversions in the same process.

Critical Impact
An attacker who supplies a malicious .docx file to a server-side conversion workflow can poison Object.prototype and, in affected versions, read arbitrary local files from the host.

Affected Products

mammoth.js versions prior to 1.12.2
mammoth.js versions 1.11.0 through 1.12.1 (additional local file disclosure impact)
Node.js applications and services that use mammoth to convert user-supplied .docx files

Discovery Timeline

2026-09-24 - CVE-2026-97151 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97151

Vulnerability Analysis

The flaw is a prototype pollution weakness categorized under CWE-1321. mammoth.js parses style definitions from the DOCX XML and stores them in plain JavaScript objects keyed by attacker-controlled values. Because these objects inherit from Object.prototype, assigning a key such as __proto__ or a nested property path writes directly to the global prototype chain. Every object in the process then observes the injected property, which can corrupt program logic across unrelated modules.

The secondary impact in versions 1.11.0 through 1.12.1 is more serious. The pollution can be used to set the internal externalFileAccess configuration flag to true. When the host process then converts another document and returns the generated HTML to the submitter, the attacker can reference local file paths and exfiltrate their contents through the rendered output.

Root Cause

The root cause is the use of object literals ({}) as maps for untrusted keys in lib/docx/styles-reader.js, lib/docx/content-types-reader.js, and lib/document-to-html.js. Because literal objects inherit from Object.prototype, writes such as styles[style.type] = ... where style.type is attacker-controlled propagate to the prototype chain.

Attack Vector

Exploitation requires an attacker to deliver a crafted .docx file to an application that invokes mammoth.convertToHtml or related APIs. No authentication or user interaction on the server is required beyond normal document submission. The attack is network-reachable in any upload-driven conversion service.

javascript

// Patch excerpt from lib/docx/styles-reader.js (commit 31f0c37)
// Before: attacker-controlled style.type was used as an object key.
// After: an explicit switch replaces the dynamic lookup, blocking
// prototype pollution via unexpected style types.
var tableStyles = {};
var numberingStyles = {};

root.getElementsByTagName("w:style").forEach(function(styleElement) {
    var style = readStyleElement(styleElement);
    var styleSet;

    switch (style.type) {
    case "paragraph":
        styleSet = paragraphStyles;
        break;
    case "character":
        styleSet = characterStyles;
        break;
    case "table":
        styleSet = tableStyles;
        break;
    case "numbering":
        styleSet = numberingStyles;
    }
});

Source: GitHub Commit 31f0c37

javascript

// Patch excerpt from lib/document-to-html.js and
// lib/docx/content-types-reader.js (commit 2888fa1)
// Replaces plain object maps with prototype-less objects.
var html = elementToHtml(document, messages, Object.create(null));
var deferredValues = Object.create(null);

function readContentTypesFromXml(element) {
    var extensionDefaults = Object.create(null);
    var overrides = Object.create(null);
    // ... populate from untrusted XML attributes
}

Source: GitHub Commit 2888fa1

Detection Methods for CVE-2026-97151

Indicators of Compromise

Converted HTML output containing unexpected content from local filesystem paths such as /etc/passwd, application configuration files, or private keys.
.docx uploads containing w:style elements with unusual or non-standard w:type attribute values that do not match paragraph, character, table, or numbering.
Node.js process logs showing unexpected property values on built-in objects, or runtime errors referencing properties that were never explicitly defined.

Detection Strategies

Inventory dependency manifests (package.json, package-lock.json, yarn.lock) across repositories and build artifacts for mammoth versions below 1.12.2.
Enable Software Composition Analysis (SCA) rules in CI to flag vulnerable mammoth ranges and block merges that reintroduce them.
Instrument document-conversion endpoints to log the size, origin, and SHA-256 hash of submitted .docx files for retrospective hunting.

Monitoring Recommendations

Monitor outbound and response payloads from conversion services for the presence of filesystem path patterns or file contents that should never appear in rendered documents.
Track unexpected file-read system calls (openat, read) originating from Node.js worker processes that only serve document conversion.
Alert on long-running Node processes that handle multiple documents in sequence, since the file-disclosure variant requires conversions to share the same polluted process.

How to Mitigate CVE-2026-97151

Immediate Actions Required

Upgrade mammoth to version 1.12.2 or later across all services and container images.
Audit application code for any explicit setting of externalFileAccess: true and remove it unless strictly required.
Restart long-running Node.js processes after upgrading to clear any state that may have been polluted at runtime.

Patch Information

The maintainer released mammoth version 1.12.2, which rewrites the style and content-type readers to avoid using attacker-controlled keys on prototype-bearing objects. The fix is implemented across commits 2888fa1 and 31f0c37, with release details in the Mammoth.js Release Notes. Install the fixed version from the NPM Package: mammoth registry.

Workarounds

Isolate document conversion in short-lived worker processes or containers so prototype pollution cannot persist across requests.
Reject .docx uploads from untrusted sources, or sandbox the conversion workflow with filesystem restrictions that deny reads outside a dedicated working directory.
Run Node.js with --disable-proto=delete to blunt __proto__-based pollution vectors as a defense-in-depth measure.

bash

# Upgrade mammoth to the patched release
npm install mammoth@1.12.2 --save

# Verify the resolved version in the lockfile
npm ls mammoth

# Harden the Node.js runtime against __proto__ pollution
node --disable-proto=delete server.js