CVE-2026-71436: Mermaid XY Charts are vulnerable to an infinite loop DoS
Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.
As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.
References
- github.com/advisories/GHSA-2v8p-3f2j-5mp7
- github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
- github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
- github.com/mermaid-js/mermaid/pull/8022
- github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- github.com/mermaid-js/mermaid/releases/tag/v10.9.8
- github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
- nvd.nist.gov/vuln/detail/CVE-2026-71436
Code Behaviors & Features
Detect and mitigate CVE-2026-71436 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →