CVE-2026-71439

Received Received - Intake

Mermaid Radar Diagram High CPU Usage Vulnerability

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71439

Affected Vendors & Products

Vendor	Product	Version / Range
mermaid	mermaid	to 11.16.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-606	The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
CWE-1322	The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.

Attack-Flow Graph

Executive Summary

This vulnerability affects Mermaid, a JavaScript tool for creating diagrams. Between versions 11.6.0 and 11.16.1, Radar Diagrams allow excessively large values for the ticks parameter. This causes high CPU usage, freezing the webpage or JavaScript process, and potential memory exhaustion until the process is killed.

Detection Guidance

This vulnerability can be detected by checking the version of Mermaid being used. If the version is between 11.6.0 and 11.16.0, the system is vulnerable. Commands to check the version depend on how Mermaid is installed (e.g., npm list mermaid or checking the version in the application's source code).

Impact Analysis

If you use Mermaid Radar Diagrams in versions 11.6.0 to 11.16.1, an attacker could exploit this to freeze your browser or JavaScript environment. This leads to unresponsiveness, crashes, or system slowdowns due to high CPU and memory consumption.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data processing delays due to system freezes. GDPR requires timely data processing, and HIPAA demands availability of systems handling health data. Exploits could lead to violations if systems become unavailable.

Mitigation Strategies

Upgrade Mermaid to version 11.16.1 or later immediately. If upgrading is not possible, restrict user input for the ticks parameter in Radar Diagrams to prevent excessive CPU usage. Monitor system performance for signs of high CPU or memory usage.

Hi! I’m here to help you understand CVE-2026-71439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70