CVE-2026-71436 Details
Description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.
A denial-of-service vulnerability has been identified in Mermaid versions 10.6.0 prior to 10.9.8 and 11.0.0-alpha.1 prior to 11.16.0. The issue arises in the XY Chart component, specifically within the 'setXAxisRangeData' function. When an X-Axis is configured with invalid parameters, it triggers an infinite loop that appends elements to an array. This loop can lead to a 'RangeError' after a few seconds or cause the page or JavaScript process to crash due to memory exhaustion, depending on the environment.
Users can update to Mermaid version 10.9.8 or 11.16.1, both of which include the necessary patch. Instructions for downloading these versions are available on the Mermaid GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |