Mermaid XY Charts are vulnerable to an infinite loop DoS

Description

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

Recommendation

Update the mermaid package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0-alpha.1, < 11.16.1

  >= 10.6.0, < 10.9.8**

• Patched version(s): **11.16.1

  10.9.8**

References

• GHSA-2v8p-3f2j-5mp7
• CVE-2026-71436
• CWE-1325
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS - CVE-2026-41150
• jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
• Mermaid radar diagrams are vulnerable to DoS - CVE-2026-71439
• Mermaid Architecture diagrams are vulnerable to prototype pollution - CVE-2026-71437

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

mermaid