npm/mermaid CVE-2026-71437: medium, EPSS 0.50%
Mermaid Architecture diagrams are vulnerable to prototype pollution
Action: Upgrade mermaid to 11.16.1 or later.
npm i mermaid@11.16.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.5.0 | 11.16.1 | - |
Fixed versions
| 11.16.1 |
Sources
- osv: GHSA-3rrr-jr9j-h3q3
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
CVE-2026-71437 · published · modified · JSON