CVE-2026-105219 mwilliamson CVE debrief

Who should care

Defenders responsible for Node.js applications that use Mammoth.js, particularly those that process .docx files, should assess exposure to this vulnerability and prioritize verification and potential updates.

Why it matters

CVE-2026-105219 is a high-severity vulnerability in Mammoth.js that could allow denial of service attacks. Defenders should verify the version in use, assess exposure, and prioritize updates to prevent potential event loop blocking.

• Denial of service attacks may be possible by supplying crafted .docx files
• Verification of Mammoth.js version and exposure is necessary
• Potential for event loop blocking requires attention from Node.js application defenders

Technical summary

The vulnerability is caused by a regular expression denial of service (ReDoS) in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. An attacker can supply a crafted .docx file with an unterminated quoted string of repeated backslash escapes to block the Node.js event loop. Defenders should prioritize verifying the version of Mammoth.js in use and assessing exposure to this vulnerability, particularly in systems that process .docx files. The issue was fixed in version 1.12.3.

Defensive priority

Defenders should prioritize verifying the version of Mammoth.js in use and assessing exposure to this vulnerability, particularly in systems that process .docx files.

Recommended defensive actions

• Verify the version of Mammoth.js in use and assess exposure to this vulnerability
• Update to version 1.12.3 or later if possible
• Monitor for potential denial of service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by overlapping regex alternatives in the style map tokeniser in lib/styles/parser/tokeniser.js. The issue was fixed in version 1.12.3. Defenders should verify the version in use and assess exposure to this vulnerability, particularly in systems that process .docx files. The vulnerability allows for denial of service attacks by supplying crafted .docx files with unterminated quoted strings of repeated backslash escapes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.