Mermaid radar diagrams are vulnerable to DoS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mermaid-js | mermaid | 11.6.0 to before 11.16.1 | 11.16.1 | Patch available | CNA |
| — | mermaid (npm) | 11.6.0 to before 11.16.1 | 11.16.1 | Patch available | GHSA-rhh3-jpg6-66xh |
- mermaid Vendormermaid-js Affected 11.6.0 to before 11.16.1 Fixed in 11.16.1 Patch available CNA
- mermaid (npm) Vendor— Affected 11.6.0 to before 11.16.1 Fixed in 11.16.1 Patch available GHSA-rhh3-jpg6-66xh
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:*:*:* | — | — | mermaid-js |
- cpe:2.3:a:mermaid_project:mermaid:*:*:*:*:*:*:*:* Versions — — ·mermaid-js
Remediation
- Fix · CNA mermaid (mermaid-js) Fixed in 11.16.1
- Fix · GHSA-rhh3-jpg6-66xh mermaid (npm) Fixed in 11.16.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Build of Podman Desktop
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71439
- 2026-10-03 Alias added: GHSA-rhh3-jpg6-66xh
References
Other 5
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
- https://github.com/mermaid-js/mermaid
More mermaid-js vulnerabilities
- TI-2026-29778 Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS CVSS 4.0MEDIUM 5.3
- TI-2025-34615 Mermaid improperly sanitizes of sequence diagram labels leading to XSS CVSS 4.0MEDIUM 5.3
- TI-2026-50057 Mermaid Architecture diagrams are vulnerable to prototype pollution CVSS 4.0MEDIUM 6.5
- TI-2022-13152 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js CVSS 3.1MEDIUM 6.1
- TI-2024-25762 Cross-site Scripting in ZenUML CVSS 3.1MEDIUM 5.4
- TI-2026-29777 Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-71439 · CVE Program
- CVE-2026-71439 · NVD
- FIRST EPSS
- GHSA-rhh3-jpg6-66xh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71439 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences