NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

🗓️ 06 Aug 2026 19:49:48Reported by PatchstackType

Mermaid XY Charts in Node Package Manager have an infinite loop Denial of Service vulnerability in versions 10.6.0 to 10.9.7.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-71436	6 Aug 202619:49	–	attackerkb
Circl	CVE-2026-71436	6 Aug 202620:35	–	circl
CVE	CVE-2026-71436	6 Aug 202619:49	–	cve
Cvelist	CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS	6 Aug 202619:49	–	cvelist
EUVD	EUVD-2026-54241	6 Aug 202619:49	–	euvd
Github Security Blog	Mermaid XY Charts are vulnerable to an infinite loop DoS	6 Aug 202619:49	–	github
NVD	CVE-2026-71436	6 Aug 202622:18	–	nvd
OSV	GHSA-2V8P-3F2J-5MP7 Mermaid XY Charts are vulnerable to an infinite loop DoS	6 Aug 202619:49	–	osv

Vulners

Node

npm mermaidRange≤>= 10.6.0, 10.9.8

Source	Link
github	www.github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
github	www.github.com/mermaid-js/mermaid/pull/8022
github	www.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
github	www.github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
github	www.github.com/mermaid-js/mermaid/releases/tag/[email protected]
github	www.github.com/mermaid-js/mermaid/releases/tag/v10.9.8
github	www.github.com/advisories/GHSA-2v8p-3f2j-5mp7

06 Aug 2026 19:49Current

5.5Medium risk

Vulners AI Score5.5

CVSS 45.3