{"action":"Upgrade mermaid to 10.9.8 or later.","affected":[{"fixed":"10.9.8","introduced":"10.6.0"},{"fixed":"11.16.1","introduced":"11.0.0-alpha.1"}],"component":"mermaid","cve_ids":["CVE-2026-71436"],"ecosystem":"npm","epss":0.00581,"exploited":false,"fixed_versions":["10.9.8","11.16.1"],"ghsa_id":"GHSA-2v8p-3f2j-5mp7","id":"tcs_01M5KEV3VCD63765D8B7Q53CMW","modified_at":"2026-09-10T03:51:12.917104069Z","published_at":"2026-08-06T19:49:48Z","references":["https://osv.dev/vulnerability/GHSA-2v8p-3f2j-5mp7","https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7","https://github.com/mermaid-js/mermaid/pull/8022","https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289","https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a","https://github.com/mermaid-js/mermaid","https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1","https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-2v8p-3f2j-5mp7","url":"https://osv.dev/vulnerability/GHSA-2v8p-3f2j-5mp7"}],"summary":"Mermaid XY Charts are vulnerable to an infinite loop DoS"}