Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M

CVE-2026-71439Mermaid radar diagrams are vulnerable to DoS

Medium 5.3

In plain English

A medium-severity security flaw in mermaid from mermaid-js. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	node-mermaid	no fix listed	DEBIAN-CVE-2026-71439
Ubuntu:22.04:LTS	node-mermaid	no fix listed	UBUNTU-CVE-2026-71439
Ubuntu:26.10	node-mermaid	no fix listed	UBUNTU-CVE-2026-71439
npm	mermaid	11.16.1	GHSA-rhh3-jpg6-66xh

Affected products (as reported)

Vendor	Product	Versions
mermaid-js	mermaid	>= 11.6.0, < 11.16.1

Weakness: CWE-606, CWE-1322 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh x_refsource_CONFIRM
https://github.com/mermaid-js/mermaid/pull/8022 x_refsource_MISC
https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e x_refsource_MISC
https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 x_refsource_MISC