Commit 1a495a9 for mammothjs
commit 1a495a98856180e25d3b166b51319b165e0ce348
Author: Michael Williamson <mike@zwobble.org>
Date: Sun May 24 10:47:31 2026 +0100
Add note on performance
diff --git a/README.md b/README.md
index 87d6143..1d05562 100644
--- a/README.md
+++ b/README.md
@@ -545,6 +545,13 @@ For instance:
To enable access when converting trusted source documents,
set `options.externalFileAccess` to `true`.
+* The conversion may exhibit pathological performance on certain documents:
+ it's likely possible to craft a source document that causes high CPU or memory usage.
+ Depending on the performance constraints of your application and the likelihood of receiving untrusted input,
+ you may wish to consider isolating any calls to Mammoth,
+ such as running Mammoth in a separate thread with a timeout,
+ to prevent denial-of-service attacks.
+
### Document transforms
**The API for document transforms should be considered unstable,