Description
Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.
Recommendation
Update the mermaid package to the latest compatible version. Followings are version details:
Affected version(s): **>= 11.0.0-alpha.1, < 11.16.1 >= 10.6.0, < 10.9.8** Patched version(s): **11.16.1 10.9.8**
References
Could your website be exposed too?
SmartScanner can check your website for Mermaid XY Charts are vulnerable to an infinite loop DoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
- Mermaid radar diagrams are vulnerable to DoS - CVE-2026-71439
- Mermaid Architecture diagrams are vulnerable to prototype pollution - CVE-2026-71437
You might also like:
See something that needs correcting? Let us knowUpdated August 06, 2026