PT-2026-68804

CVE-2026-71436

Published

2026-08-06

Updated

2026-09-18

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mermaid versions 10.6.0 through 10.9.7 Mermaid versions 11.0.0 through 11.16.0

Description Mermaid XY Charts are subject to a denial of service via an infinite loop in the setXAxisRangeData() function when an X-Axis is configured with invalid parameters. During the loop, elements are continuously appended to an array, which typically results in a RangeError after several seconds or may cause the JavaScript process or page to crash due to memory exhaustion, depending on the environment.

Recommendations Update Mermaid versions 10.6.0 through 10.9.7 to version 10.9.8. Update Mermaid versions 11.0.0 through 11.16.0 to version 11.16.1.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-835: Loop with Unreachable Exit Condition (\'Infinite Loop\')

CWE-1325: Improperly Controlled Sequential Memory Allocation

Related identifiers

CVE-2026-71436

GHSA-2V8P-3F2J-5MP7