CVE-2026-71439: CWE-606: Unchecked Input for Loop Condition in mermaid-js mermaid
Mermaid versions from 11.6.0 up to but not including 11.16.1 have a vulnerability in Radar Diagrams where the ticks parameter can accept arbitrarily large values. This unchecked input can cause excessive CPU usage and freeze the rendering process, potentially leading to memory exhaustion and requiring process termination. The issue is fixed in version 11.16.1.
AI Analysis
Technical Summary
CVE-2026-71439 is a medium severity vulnerability in the mermaid-js mermaid library affecting versions >=11.6.0 <11.16.1. The Radar Diagrams feature allows the ticks parameter to be set to arbitrarily large values without proper input validation, causing high CPU consumption and potentially freezing the JavaScript process or webpage rendering. This denial-of-service condition arises from unchecked loop conditions (CWE-606) and can lead to memory exhaustion. The vulnerability is resolved in version 11.16.1.
Potential Impact
An attacker or user providing large values for the ticks parameter in Radar Diagrams can cause the rendering process to consume excessive CPU resources and freeze, potentially leading to denial of service by exhausting memory and requiring process termination. There is no indication of privilege escalation or data compromise. The impact is limited to availability degradation of the affected application or webpage.
Mitigation Recommendations
Upgrade mermaid to version 11.16.1 or later where this issue is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 11.16.1.
CVE-2026-71439: CWE-606: Unchecked Input for Loop Condition in mermaid-js mermaid
Description
Mermaid versions from 11.6.0 up to but not including 11.16.1 have a vulnerability in Radar Diagrams where the ticks parameter can accept arbitrarily large values. This unchecked input can cause excessive CPU usage and freeze the rendering process, potentially leading to memory exhaustion and requiring process termination. The issue is fixed in version 11.16.1.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71439 is a medium severity vulnerability in the mermaid-js mermaid library affecting versions >=11.6.0 <11.16.1. The Radar Diagrams feature allows the ticks parameter to be set to arbitrarily large values without proper input validation, causing high CPU consumption and potentially freezing the JavaScript process or webpage rendering. This denial-of-service condition arises from unchecked loop conditions (CWE-606) and can lead to memory exhaustion. The vulnerability is resolved in version 11.16.1.
Potential Impact
An attacker or user providing large values for the ticks parameter in Radar Diagrams can cause the rendering process to consume excessive CPU resources and freeze, potentially leading to denial of service by exhausting memory and requiring process termination. There is no indication of privilege escalation or data compromise. The impact is limited to availability degradation of the affected application or webpage.
Mitigation Recommendations
Upgrade mermaid to version 11.16.1 or later where this issue is fixed. No other official remediation or temporary workaround is documented. Patch status is confirmed fixed in 11.16.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-06T16:28:51.183Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a75070fbf8831d5395f5de3
Added to database: 08/06/2026, 22:13:35 UTC
Last enriched: 08/06/2026, 22:28:11 UTC
Last updated: 08/07/2026, 02:06:14 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.