CVE-2026-71439: CWE-606: Unchecked Input for Loop Condition in mermaid-js mermaid
Mermaid versions from 11.6.0 up to but not including 11.16.1 contain a vulnerability where the Radar Diagrams feature accepts arbitrarily large values for the ticks parameter. This unchecked input can cause excessive CPU usage and potentially freeze the rendering webpage or JavaScript process until it is terminated due to resource exhaustion. The issue is resolved in version 11.16.1.
AI Analysis
Technical Summary
CVE-2026-71439 is a medium severity vulnerability in the mermaid-js mermaid JavaScript library affecting versions >=11.6.0 <11.16.1. The Radar Diagrams feature allows unvalidated large values for the ticks parameter, leading to high CPU consumption and potential freezing of the rendering process. This is due to unchecked input for a loop condition (CWE-606). The vulnerability can cause denial of service by exhausting system resources. It is fixed in version 11.16.1.
Potential Impact
The vulnerability can cause high CPU usage and freeze the webpage or JavaScript process rendering Mermaid diagrams, potentially leading to denial of service until the process is killed. There is no indication of privilege escalation, data leakage, or remote code execution. The impact is limited to performance degradation and availability disruption.
Mitigation Recommendations
Upgrade Mermaid to version 11.16.1 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated.
CVE-2026-71439: CWE-606: Unchecked Input for Loop Condition in mermaid-js mermaid
Description
Mermaid versions from 11.6.0 up to but not including 11.16.1 contain a vulnerability where the Radar Diagrams feature accepts arbitrarily large values for the ticks parameter. This unchecked input can cause excessive CPU usage and potentially freeze the rendering webpage or JavaScript process until it is terminated due to resource exhaustion. The issue is resolved in version 11.16.1.
CVSS v4.0
Score 5.3medium
Affected software
mermaid-js
mermaid
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71439 is a medium severity vulnerability in the mermaid-js mermaid JavaScript library affecting versions >=11.6.0 <11.16.1. The Radar Diagrams feature allows unvalidated large values for the ticks parameter, leading to high CPU consumption and potential freezing of the rendering process. This is due to unchecked input for a loop condition (CWE-606). The vulnerability can cause denial of service by exhausting system resources. It is fixed in version 11.16.1.
Potential Impact
The vulnerability can cause high CPU usage and freeze the webpage or JavaScript process rendering Mermaid diagrams, potentially leading to denial of service until the process is killed. There is no indication of privilege escalation, data leakage, or remote code execution. The impact is limited to performance degradation and availability disruption.
Mitigation Recommendations
Upgrade Mermaid to version 11.16.1 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-06T16:28:51.183Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75070fbf8831d5395f5de3
Added to database: 08/06/2026, 22:13:35 UTC
Last enriched: 08/14/2026, 16:08:53 UTC
Last updated: 09/21/2026, 22:01:37 UTC
Views: 56
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.