mammoth.js: Regular expression denial of service in style map tokeniser
Summary
mammoth.js, a Node.js library that converts .docx files to HTML, contains a regular expression denial of service (ReDoS) flaw in its style map tokeniser. An attacker can supply a crafted .docx file with an unterminated quoted string of repeated backslash escapes in the style map, which blocks the Node.js event loop. The impact is limited to denial of service; no confidentiality or integrity impact is known. Exposure depends on whether an application passes uploaded or external .docx files to mammoth.
Affected
- mammoth.js 1.3.0 up to, but not including, 1.12.3
- Default configuration: unaffected
- Affected component: lib/styles/parser/tokeniser.js (style map)
Fixed in
- Fixed in mammoth.js 1.12.3
- Note: an unofficial aggregator lists 1.12.4 and above; the fix commit dc49225425c2c07de0a6dc3529f2386c82a032b4 should be confirmed
- Current release: 1.13.0 (upgrade to 1.12.3 or later after testing)
Workaround
- No vendor workaround known.
- Do not convert .docx files from untrusted sources.
- Run conversion in a separate worker process with a timeout.
- Limit upload size.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in the CISA Known Exploited Vulnerabilities catalog (checked via an aggregator only).
- No public proof-of-concept exploit confirmed.
- EPSS score: 0.00358.
Our recommendation
- Check lockfiles and deployed manifests for mammoth versions below 1.12.3, including transitive dependencies.
- Upgrade to 1.12.3 or later after testing.
- Prioritise internet-facing applications that convert uploaded Word files.
- Until patched, isolate document conversion in a worker process with a timeout and reject untrusted files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record / VulnCheck advisory www.vulncheck.com
- mammoth.js fix commit github.com
- mammoth.js issue #487 github.com
- mammoth.js repository github.com
- OSV entry osv.dev
- Tenable CVE entry (EPSS) www.tenable.com
- Mend vulnerability database www.mend.io
- TheHackerWire (exploitation status, aggregator) www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:37.
Original description (NVD)
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.
NVD references (5)
- https://github.com/mwilliamson/mammoth.js
- https://github.com/mwilliamson/mammoth.js/blob/1.12.2/lib/styles/parser/tokeniser.js#L6-L30
- https://github.com/mwilliamson/mammoth.js/commit/dc49225425c2c07de0a6dc3529f2386c82a032b4
- https://github.com/mwilliamson/mammoth.js/issues/487
- https://www.vulncheck.com/advisories/mammoth-js-1.3.0-before-1.12.3-redos-via-style-map-tokeniser
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.