Mermaid XY Charts are vulnerable to an infinite loop DoS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mermaid-js | mermaid | 10.6.0 to before 10.9.8; 11.0.0-alpha.1 to before 11.16.1 | 10.9.8, 11.16.1 | Patch available | CNA |
| — | mermaid (npm) | 10.6.0 to before 10.9.8 | 10.9.8 | Patch available | GHSA-2v8p-3f2j-5mp7 |
| — | mermaid (npm) | 11.0.0-alpha.1 to before 11.16.1 | 11.16.1 | Patch available | GHSA-2v8p-3f2j-5mp7 |
- mermaid Vendormermaid-js Affected 10.6.0 to before 10.9.8; 11.0.0-alpha.1 to before 11.16.1 Fixed in 10.9.8, 11.16.1 Patch available CNA
- mermaid (npm) Vendor— Affected 10.6.0 to before 10.9.8 Fixed in 10.9.8 Patch available GHSA-2v8p-3f2j-5mp7
- mermaid (npm) Vendor— Affected 11.0.0-alpha.1 to before 11.16.1 Fixed in 11.16.1 Patch available GHSA-2v8p-3f2j-5mp7
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:*:*:* | — | — | mermaid-js |
- cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:*:*:* Versions — — ·mermaid-js
Remediation
- Fix · CNA mermaid (mermaid-js) Fixed in 10.9.8, 11.16.1
- Fix · GHSA-2v8p-3f2j-5mp7 mermaid (npm) Fixed in 10.9.8 Advisory →
- Fix · GHSA-2v8p-3f2j-5mp7 mermaid (npm) Fixed in 11.16.1 Advisory →
Red Hat 1 advisory
- RHSA-2026:68754 Released 2026-09-17 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.1 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:68754 |
Not affected: 3 products
- Red Hat Build of Podman Desktop
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Dev Spaces 3.30
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71436
- 2026-10-03 Alias added: GHSA-2v8p-3f2j-5mp7
References
Other 7
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
- https://github.com/mermaid-js/mermaid/releases/tag/[email protected]
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
- https://github.com/mermaid-js/mermaid
More mermaid-js vulnerabilities
- TI-2026-29778 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVSS 4.0MEDIUM 5.3
- TI-2025-34615 Mermaid improperly sanitizes of sequence diagram labels leading to XSS CVSS 4.0MEDIUM 5.3
- TI-2026-50057 Mermaid Architecture diagrams are vulnerable to prototype pollution CVSS 4.0MEDIUM 6.5
- TI-2022-13152 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js CVSS 3.1MEDIUM 6.1
- TI-2024-25762 Cross-site Scripting in ZenUML CVSS 3.1MEDIUM 5.4
- TI-2026-29777 Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-71436 · CVE Program
- CVE-2026-71436 · NVD
- FIRST EPSS
- GHSA-2v8p-3f2j-5mp7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71436 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences