{"id":"CVE-2026-71436","aliases":["GHSA-2v8p-3f2j-5mp7"],"url":"https://o3.security/vulnerability/CVE-2026-71436","summary":"Mermaid XY Charts are vulnerable to an infinite loop DoS","details":"### Impact\n\nMermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters.\n\nAs each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.\n\n#### Proof-of-concept\n\n```txt\nxychart\n  x-axis 1 --> 1\n  line [1, 2]\n```\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Workarounds\n\nThere are no known workarounds. Please update to the latest version or apply the patch.\n\n### References\n\n- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289\n- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1\n- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a\n- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8","published":"2026-08-06T19:49:44.739Z","modified":"2026-10-28T02:30:22.067040746Z","cvss":null,"epss":{"score":0.00408,"percentile":0.34659,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"mermaid","fixedVersion":"10.9.8"},{"ecosystem":"npm","name":"mermaid","fixedVersion":"11.16.1"}],"fix":{"url":"https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289","label":"mermaid-js/mermaid@630aa7e"},"references":[{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1"},{"type":"WEB","url":"https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71436.json"},{"type":"ADVISORY","url":"https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71436"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a"},{"type":"FIX","url":"https://github.com/mermaid-js/mermaid/pull/8022"},{"type":"PACKAGE","url":"https://github.com/mermaid-js/mermaid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:22.067040746Z"}}