GHSA-rhh3-jpg6-66xh CVE-2026-71439
Mermaid radar diagrams are vulnerable to DoS
- Severity
- 5.3 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.71% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-606 Unchecked Input for Loop Condition
- CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context
- Fix
11.16.1- Upgrade mermaid to this version or later
Description
Impact
Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.
Proof-of-concept
radar-beta
axis a, b
curve c {1, 1}
ticks 1000000000
Patches
Has the problem been patched? What versions should users upgrade to?
This problem has been patched by https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e, which was released in Mermaid v11.16.1
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
There are no known workarounds without updating to a patched version of mermaid.
References
Are there any links users can visit to find out more?
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mermaid npm → 11.16.1
- npm
npm install mermaid@11.16.1- yarn
yarn add mermaid@11.16.1- pnpm
pnpm add mermaid@11.16.1
Severity breakdown
CVSS 4.0 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- Low
Weakness
CWE-606: Unchecked Input for Loop Condition
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
How to prevent it
- Implementation: Do not use user-controlled data for loop conditions.
- Implementation: Perform input validation.
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context
The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
How to prevent it
- Implementation: Generally speaking, blocking calls should be replaced with non-blocking alternatives that can be used asynchronously. Expensive computations should be passed off to worker threads, although the correct approach depends on the framework being used.
- Implementation: For expensive computations, consider breaking them up into multiple smaller computations. Refer to the documentation of the framework being used for guidance.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution | Low | Also affects mermaid |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram | Medium | Also affects mermaid |
| GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution | Medium | Also affects mermaid |
| GHSA-2v8p-3f2j-5mp7 Mermaid XY Charts are vulnerable to an infinite loop DoS | Medium | Also affects mermaid |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection | Medium | Also affects mermaid |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS | Medium | Also affects mermaid |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection | Medium | Also affects mermaid |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection | Medium | Also affects mermaid |
Credits: aloisklink
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor