CVE-2026-105219

Published 4 October 2026 · tracked since 4 October 2026

Description

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in ma

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105217 LOW 3.1
• CVE-2026-105089 HIGH 8.7
• CVE-2026-105224 MEDIUM 5.4
• CVE-2026-105215 CRITICAL 9.1
• CVE-2026-105158 HIGH 7.3
• CVE-2026-105156 LOW 3.7
• CVE-2026-105146 MEDIUM 4.7
• CVE-2026-105144 MEDIUM 5.3
• CVE-2026-105137 MEDIUM 5
• CVE-2026-86817

→ Open the live CVE board · all tools