{
"id": "GHSA-2v8p-3f2j-5mp7",
"aliases": [
"CVE-2026-71436"
],
"details": "### Impact\n\nMermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters.\n\nAs each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.\n\n#### Proof-of-concept\n\n```txt\nxychart\n x-axis 1 --> 1\n line [1, 2]\n```\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Workarounds\n\nThere are no known workarounds. Please update to the latest version or apply the patch.\n\n### References\n\n- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289\n- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1\n- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a\n- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8",
"summary": "Mermaid XY Charts are vulnerable to an infinite loop DoS",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.6.0"
},
{
"fixed": "10.9.8"
}
]
}
],
"package": {
"name": "mermaid",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-alpha.1"
},
{
"fixed": "11.16.1"
}
]
}
],
"package": {
"name": "mermaid",
"ecosystem": "npm"
}
}
],
"modified": "2026-08-06T19:49:48Z",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"
}
],
"published": "2026-08-06T19:49:48Z",
"references": [
{
"url": "https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7",
"type": "WEB"
},
{
"url": "https://github.com/mermaid-js/mermaid/pull/8022",
"type": "WEB"
},
{
"url": "https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289",
"type": "WEB"
},
{
"url": "https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a",
"type": "WEB"
},
{
"url": "https://github.com/mermaid-js/mermaid",
"type": "PACKAGE"
},
{
"url": "https://github.com/mermaid-js/mermaid/releases/tag/[email protected] ",
"type": "WEB"
},
{
"url": "https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-1325",
"CWE-835"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-08-06T19:49:48Z"
}
}