mammoth.js vulnerabilities

2 known vulnerabilities in mammoth.js from Mwilliamson. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  mammoth.js: Inefficient Regular Expression Complexity

  CVE-2026-105219Oct 4, 2026Mwilliamson

  Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted st

• 8.4 High severity

  mammoth.js: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-97151Sep 24, 2026Mwilliamson

  mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, application