Mermaid configuration APIs allow prototype pollution

Description

Mermaid’s configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid’s internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): **< 10.9.8

  >= 11.0.0-alpha.1, < 11.16.1**

• Patched version(s): **10.9.8

  11.16.1**

References

• GHSA-c4c3-pg64-4m4v
• CVE-2026-71438
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• Mermaid Architecture diagrams are vulnerable to prototype pollution - CVE-2026-71437
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es - CVE-2026-2950
• Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mermaid