Mermaid radar diagrams are vulnerable to DoS

Description

Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): >= 11.6.0, < 11.16.1
• Patched version(s): 11.16.1

References

• GHSA-rhh3-jpg6-66xh
• CVE-2026-71439
• CWE-1322
• CWE-606
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150
• Mermaid Architecture diagrams are vulnerable to prototype pollution - CVE-2026-71437
• Mermaid XY Charts are vulnerable to an infinite loop DoS - CVE-2026-71436
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mermaid