CVE-2026-71436
1 advisory.
npm/mermaid CVE-2026-71436: medium, EPSS 0.58%
Mermaid XY Charts are vulnerable to an infinite loop DoS
Action: Upgrade mermaid to 10.9.8 or later.
npm i mermaid@10.9.8npm i mermaid@11.16.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.6.0 | 10.9.8 | - |
| 11.0.0-alpha.1 | 11.16.1 | - |
Fixed versions
| 10.9.8 | 11.16.1 |
Sources
- osv: GHSA-2v8p-3f2j-5mp7
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
CVE-2026-71436 · published · modified · JSON