{"id":"GHSA-2v8p-3f2j-5mp7","revision":"4fc68ace0d3145aea19ac4dc907093f3","records":[{"revision":"4fc68ace0d3145aea19ac4dc907093f3","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2v8p-3f2j-5mp7","aliases":["CVE-2026-71436"],"title":"Mermaid XY Charts are vulnerable to an infinite loop DoS","description":"### Impact\n\nMermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters.\n\nAs each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.\n\n#### Proof-of-concept\n\n```txt\nxychart\n  x-axis 1 --> 1\n  line [1, 2]\n```\n\n### Patches\n\nThis has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).\n\nA backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8)\n\n### Workarounds\n\nThere are no known workarounds. Please update to the latest version or apply the patch.\n\n### References\n\n- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289\n- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1\n- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a\n- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8","state":0,"publishedAt":"2026-08-06T19:49:48+00:00","modifiedAt":"2026-09-10T03:51:12.9171041+00:00","affected":[{"ecosystem":"npm","name":"mermaid","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"10.6.0"},{"kind":"fixed","version":"10.9.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"mermaid","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.0.0-alpha.1"},{"kind":"fixed","version":"11.16.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7","https://github.com/mermaid-js/mermaid/pull/8022","https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289","https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a","https://github.com/mermaid-js/mermaid","https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1","https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8"],"sourceUrl":"https://github.com/advisories/GHSA-2v8p-3f2j-5mp7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2v8p-3f2j-5mp7","identifiers":["GHSA-2v8p-3f2j-5mp7","CVE-2026-71436"]},"retained":false,"historicalAffected":[]}],"coverage":[]}