Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-71439: Mermaid radar diagrams can freeze webpages
CVE-2026-71439 · published 3 months ago
Summary
Mermaid versions 11.6.0 through 11.16.1 let radar diagrams accept very large tick values, which can drive the CPU to max and make the page or script hang. This can effectively stop the diagram from rendering until the process is stopped. Upgrade to Mermaid 11.16.1 or later to stop the issue.
What to do
- Update GitHub Actions mermaid to version 11.16.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | mermaid |
>= 11.6.0, < 11.16.1 Fix: upgrade to 11.16.1
|
| – | mermaid-js | mermaid | >= 11.6.0, < 11.16.1 |
| Debian:11 | debian | node-mermaid | All versions |
| Debian:14 | debian | node-mermaid | All versions |
| Ubuntu:22.04:LTS | canonical | node-mermaid | All versions |
Original advisory text
Mermaid radar diagrams are vulnerable to DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh Vendor Advisory
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 URL
- https://github.com/advisories/GHSA-rhh3-jpg6-66xh
- https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679... Patch
- https://github.com/mermaid-js/mermaid Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71439... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-71439 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-71439 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-71439 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-71439 Third Party Advisory
- https://github.com/mermaid-js/mermaid/pull/8022 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-606Unchecked Input for Loop Condition
CWE-1322Use of Blocking Code in Single-threaded, Non-blocking Context
Timeline
Published6 Aug 2026
Updated4 Nov 2026
First seen6 Aug 2026
Sources
GHSA-rhh3-jpg6-66xh · GHSA
CVE-2026-71439 · NVD
GHSA-rhh3-jpg6-66xh · OSV
CVE-2026-71439 · MITRE
CVE-2026-71439 · OSV
DEBIAN-CVE-2026-71439 · OSV
UBUNTU-CVE-2026-71439 · OSV
Track software like this
Free during beta