CVE-2026-71436 in Mermaid
Summary
by MITRE • 08/07/2026
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Mermaid XY Charts represents a classic denial of service weakness that exploits improper input validation within the setXAxisRangeData function. This flaw exists in versions ranging from 10.6.0 through 10.9.8 and 11.16.1, creating a persistent security risk for systems that rely on Mermaid's diagram rendering capabilities. The issue manifests when users configure X-Axis parameters with invalid data, triggering an infinite loop condition that can severely impact system stability and availability.
The technical implementation of this vulnerability stems from inadequate boundary checking and input sanitization within the chart configuration logic. When malformed X-Axis parameters are processed, the setXAxisRangeData function enters an iterative processing loop where each iteration appends elements to an array structure without proper termination conditions. This creates a scenario where the loop continues indefinitely until system resources are exhausted, typically manifesting as a RangeError after several seconds of operation but potentially leading to complete system crashes due to memory exhaustion in resource-constrained environments.
From a cybersecurity perspective, this vulnerability aligns with CWE-835, which addresses infinite loops and their potential for denial of service attacks. The flaw represents a significant operational risk as it can be exploited through simple configuration inputs that would normally be considered benign or invalid. Attackers could leverage this weakness to disrupt services by causing JavaScript processes to consume excessive memory or CPU resources, potentially affecting web applications that integrate Mermaid charting functionality.
The impact of this vulnerability extends beyond simple service disruption to encompass broader system stability concerns. In web environments where Mermaid diagrams are rendered dynamically, an attacker could cause complete browser tab crashes or even entire application freezes through carefully crafted invalid axis parameters. The memory exhaustion scenario particularly affects server-side JavaScript implementations where resource limits may not be adequately enforced, creating opportunities for more severe operational impacts.
The remediation approach focuses on proper input validation and loop termination mechanisms within the affected function. Version 10.9.8 and 11.16.1 contain fixes that implement appropriate bounds checking and parameter validation to prevent the infinite iteration condition from occurring. These patches align with ATT&CK technique T1499.004, which covers resource exhaustion attacks through malformed inputs, ensuring that the system properly handles edge cases without compromising operational integrity.
Organizations using Mermaid charts should prioritize updating to patched versions as a critical security measure. The vulnerability demonstrates the importance of input validation in client-side JavaScript libraries and highlights how seemingly minor configuration errors can lead to significant operational disruptions. System administrators should also consider implementing additional monitoring for unusual memory usage patterns that might indicate exploitation attempts, particularly in environments where Mermaid functionality is exposed to untrusted user inputs or automated processing systems.