Is CVE-2026-105219 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-105219?

CVE-2026-105219 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-105219

Description

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in mammoth/style-map to block the Node.js event loop.