CVE-2026-71436

Name of the Vulnerable Software and Affected Versions Mermaid versions 10.6.0 through 10.9.7 Mermaid versions 11.0.0 through 11.16.0

Description Mermaid XY Charts are subject to a denial of service via an infinite loop in the setXAxisRangeData() function when an X-Axis is configured with invalid parameters. During the loop, elements are continuously appended to an array, which typically results in a RangeError after several seconds or may cause the JavaScript process or page to crash due to memory exhaustion, depending on the environment.

Recommendations Update Mermaid versions 10.6.0 through 10.9.7 to version 10.9.8. Update Mermaid versions 11.0.0 through 11.16.0 to version 11.16.1.