CVE-2026-71439: Mermaid Package Radar Diagrams Vulnerable to Denial of Service (DoS)
Summary
CVE-2026-71439: Mermaid radar diagrams are vulnerable to DoS. Affects mermaid versions >= 11.6.0, < 11.16.1. Fixed in 11.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mermaid is an open-source JavaScript library that enables the generation of diagrams and visualizations from text descriptions. It is widely used for creating flowcharts, sequence diagrams, and radar diagrams, among others. The library is popular among developers for its simplicity and ability to integrate with various platforms. However, a recent vulnerability has been identified in the radar diagram feature, which allows for the input of excessively large values for ticks, leading to potential performance issues.
Vulnerability Detail
The vulnerability arises from the ability to specify arbitrary large values for the 'ticks' parameter in Mermaid radar diagrams. This can lead to high CPU usage and freezing of the webpage or JavaScript process for extended periods. Eventually, the process may be terminated due to out-of-memory (OOM) errors. The issue is rooted in the lack of input validation for the ticks parameter, which allows users to exploit this feature by inputting extremely large numbers, causing Denial of Service (DoS) conditions.
How To Fix
Latest published version: 12.2.0 as of 22 Oct 2026
npm install mermaid@12.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.16.1
This is the first release that contains the fix.
npm install mermaid@11.16.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability without upgrading to the patched version of Mermaid. It is strongly recommended to update to version 11.16.1 or later.
Conclusion
The vulnerability identified as CVE-2026-71439 in the Mermaid package poses a significant risk due to its potential to cause Denial of Service through the misuse of the 'ticks' parameter in radar diagrams. Users are advised to upgrade to version 11.16.1 to mitigate this risk effectively.
See every vulnerability recorded for mermaid →
FAQ
The vulnerability allows for the input of excessively large values for the 'ticks' parameter in radar diagrams, leading to high CPU usage and potential freezing of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Unfortunately, there are no known workarounds to prevent this issue without upgrading to the patched version of Mermaid.
More information about the patch can be found in the commit history at https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e.
References
Related vulnerabilities
Recent vulnerabilities recorded for mermaid.
