CVE-2026-71439 Mermaid radar diagrams are vulnerable to DoS
Attackers can cause denial of service in Mermaid radar diagrams by supplying large tick values, freezing the rendering process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-71439?
CVE-2026-71439 is a medium-severity denial of service vulnerability in mermaid-js mermaid, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript process for long periods of time, potentially until the process is killed from memory exhaustion. This issue is fixed in version 11.16.1.
Which versions are affected by CVE-2026-71439?
2 open source packages ship an affected version, including mermaid.
| Package | Affected | Fixed in |
|---|---|---|
mermaid npm | From 11.6.0 | 11.16.1 |
mermaid npm | From 11.6.0 | 11.16.1 |
How do I fix CVE-2026-71439?
Upgrade mermaid to 11.16.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-71439 being exploited?
There is no known exploitation of CVE-2026-71439 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-VU48904, DEBIAN-CVE-2026-71439, GHSA-rhh3-jpg6-66xh, MINI-j3xg-fphv-8vw4, MINI-vh8f-vjh6-396q, UBUNTU-CVE-2026-71439.