PT-2026-68981 · Npm · Mermaid

Publicado

2026-08-06

·

Atualizado

2026-08-06

CVSS v4.0

5.3

Média

VetorAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Impact

Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.

Proof-of-concept

txt
radar-beta
 axis a, b
 curve c {1, 1}
 ticks 1000000000

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?
There are no known workarounds without updating to a patched version of mermaid.

References

Are there any links users can visit to find out more?

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

GHSA-RHH3-JPG6-66XH

Produtos afetados

Mermaid