CVE-2026-71439

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71439
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71439.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71439
Aliases
Downstream
Related
Published
2026-08-06T20:01:04.423Z
Modified
2026-08-09T03:30:37.071417483Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L CVSS Calculator
Summary
Mermaid radar diagrams are vulnerable to DoS
Details

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.

Database specific 
{
    "cwe_ids": [
        "CWE-1322",
        "CWE-606"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71439.json"
}
References

Affected packages

Git / github.com/mermaid-js/mermaid

Affected ranges

Type
GIT
Repo
https://github.com/mermaid-js/mermaid
Events
Introduced
7b2083926dbe3b6280f42376a0d4195b2c72fb8e
Fixed
59b22fad2b3bb04f87a476c84a8a2b24679e607e
Fixed
7ecca0cd7f1658ef74f4e7e91f925724ef403bbf
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "11.6.0"
        },
        {
            "fixed": "11.16.1"
        }
    ]
}

Affected versions

@mermaid-js/examples@1.*
@mermaid-js/examples@1.1.0
@mermaid-js/examples@1.2.0
@mermaid-js/examples@1.3.0
@mermaid-js/layout-elk@0.*
@mermaid-js/layout-elk@0.1.8
@mermaid-js/layout-elk@0.1.9
@mermaid-js/layout-elk@0.2.0
@mermaid-js/layout-elk@0.2.1
@mermaid-js/layout-elk@0.2.2
@mermaid-js/layout-tidy-tree@0.*
@mermaid-js/layout-tidy-tree@0.2.0
@mermaid-js/layout-tidy-tree@0.2.1
@mermaid-js/layout-tidy-tree@0.2.2
@mermaid-js/mermaid-zenuml@0.*
@mermaid-js/mermaid-zenuml@0.2.1
@mermaid-js/mermaid-zenuml@0.2.2
@mermaid-js/mermaid-zenuml@0.2.3
@mermaid-js/parser@0.*
@mermaid-js/parser@0.4.0
@mermaid-js/parser@0.5.0
@mermaid-js/parser@0.6.0
@mermaid-js/parser@0.6.1
@mermaid-js/parser@0.6.3
@mermaid-js/parser@1.*
@mermaid-js/parser@1.0.0
@mermaid-js/parser@1.0.1
@mermaid-js/parser@1.1.0
@mermaid-js/parser@1.1.1
@mermaid-js/parser@1.2.0
@mermaid-js/tiny@11.*
@mermaid-js/tiny@11.10.0
@mermaid-js/tiny@11.10.1
@mermaid-js/tiny@11.11.0
@mermaid-js/tiny@11.12.0
@mermaid-js/tiny@11.12.1
@mermaid-js/tiny@11.12.3
@mermaid-js/tiny@11.13.0
@mermaid-js/tiny@11.14.0
@mermaid-js/tiny@11.16.0
@mermaid-js/tiny@11.7.0
@mermaid-js/tiny@11.8.0
@mermaid-js/tiny@11.8.1
mermaid@11.*
mermaid@11.10.0
mermaid@11.10.1
mermaid@11.11.0
mermaid@11.12.0
mermaid@11.12.1
mermaid@11.12.2
mermaid@11.12.3
mermaid@11.13.0
mermaid@11.14.0
mermaid@11.15.0
mermaid@11.16.0
mermaid@11.6.0
mermaid@11.7.0
mermaid@11.8.0
mermaid@11.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71439.json"