CVE-2026-71436: Mermaid Denial of Service Vulnerability
MODERATECVE-2026-71436 is a MODERATE denial of service vulnerability (CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')) affecting Mermaid libraries in the npm ecosystem. The issue involves mermaid xy charts are vulnerable to an infinite loop dos. Remediation is available by upgrading affected packages to version 10.9.8, 11.16.1.
CVE-2026-71436 at a Glance
How to Fix CVE-2026-71436
To remediate this vulnerability, upgrade all affected Mermaid dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install mermaid@10.9.8npm install mermaid@11.16.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls mermaidHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-71436, inspect your project dependencies using npm:
npm ls mermaidAnalyze the terminal output to locate any version of Mermaid in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 10.9.8), your application is affected.
Note: The npm ls mermaid command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop'), where the product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. In Mermaid, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-71436 Affected Mermaid Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
mermaid
|
npm |
≥ 10.6.0
< 10.9.8
|
10.9.8
|
|
mermaid
|
npm |
≥ 11.0.0-alpha.1
< 11.16.1
|
11.16.1
|
References
Frequently Asked Questions
What is CVE-2026-71436?
Which Mermaid versions are affected?
What version fixes CVE-2026-71436?
Is mermaid affected?
What CWE is associated with CVE-2026-71436?
How can I check npm dependencies for CVE-2026-71436?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-2v8p-3f2j-5mp7",
"modified" : "2026-08-06T19:49:48Z",
"published" : "2026-08-06T19:49:48Z",
"aliases" : [ "CVE-2026-71436" ],
"summary" : "Mermaid XY Charts are vulnerable to an infinite loop DoS",
"details" : "### Impact\n\nMermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters.\n\nAs each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.\n\n#### Proof-of-concept\n\n```txt\nxychart\n x-axis 1 --> 1\n line [1, 2]\n```\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Workarounds\n\nThere are no known workarounds. Please update to the latest version or apply the patch.\n\n### References\n\n- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289\n- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1\n- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a\n- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "mermaid"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "10.6.0"
}, {
"fixed" : "10.9.8"
} ]
} ]
}, {
"package" : {
"ecosystem" : "npm",
"name" : "mermaid"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "11.0.0-alpha.1"
}, {
"fixed" : "11.16.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7"
}, {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/pull/8022"
}, {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"
}, {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/mermaid-js/mermaid"
}, {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1"
}, {
"type" : "WEB",
"url" : "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1325", "CWE-835" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-08-06T19:49:48Z",
"nvd_published_at" : null
}
}