Is there a public PoC exploit available for CVE-2026-71436?

Yes, a public proof-of-concept exploit is available for CVE-2026-71436. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-71436?

Yes, a patch is available for CVE-2026-71436. Update the affected software to the latest version immediately.

Mermaid CVE-2026-71436

Q: What is the CVSS score of CVE-2026-71436?

CVE-2026-71436 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54241 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-08-06 https://github.com/mermaid-js/mermaid

GHSA-2v8p-3f2j-5mp7

Denial Of Service

5.3

CVSS 4.0 · Vendor: https://github.com/mermaid-js/mermaid

Severity by source

Vendor (https://github.com/mermaid-js/mermaid) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-delivered diagram input with no auth requirement at library level; purely availability impact, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/mermaid-js/mermaid).

CVSS VectorVendor: https://github.com/mermaid-js/mermaid

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 22:22 NVD

5.3 (MEDIUM)

Source Code Evidence Fetched

Aug 06, 2026 - 20:36 vuln.today

Analysis Generated

Aug 06, 2026 - 20:36 vuln.today

DescriptionCVE.org

Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.

Proof-of-concept

txt

xychart
  x-axis 1 --> 1
  line [1, 2]

Patches

This has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8

Workarounds

There are no known workarounds. Please update to the latest version or apply the patch.

References

https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

AnalysisAI

Infinite-loop denial of service in Mermaid's XY chart renderer allows any party that can supply diagram input to crash the JavaScript process or browser tab. The setXAxisRangeData() function in npm/mermaid enters an unbounded loop when an x-axis range is defined with identical start and end values, growing an array until memory is exhausted or a RangeError: Invalid array length is thrown. A proof-of-concept is publicly embedded in the GitHub security advisory (GHSA-2v8p-3f2j-5mp7), making exploitation trivial; no CISA KEV listing has been issued.

Technical ContextAI

Mermaid is a widely used JavaScript diagramming library (pkg:npm/mermaid) that parses text-based diagram syntax and renders SVG output in browsers or Node.js environments. The XY chart module (xychart/xychart-beta diagram type) includes a function setXAxisRangeData() responsible for computing axis tick data from a user-supplied range. CWE-835 (Loop with Unreachable Exit Condition) is the root cause: when the x-axis start and end values are equal (a zero-width range such as x-axis 1 --> 1), the loop's termination condition is never satisfied, causing it to iterate indefinitely while appending elements to an internal array. The fix in commit 630aa7e5 adds explicit handling for zero-width ranges, confirmed by changeset entry 'fix(xychart): support zero-width x-axis ranges'. Affected packages are pkg:npm/mermaid in both the v10 and v11 release lines.

RemediationAI

Upgrade to Mermaid v11.16.1 (for v11 users) or v10.9.8 (for v10 users). Release artifacts and changelogs are available at https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1 and https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 respectively; the underlying fix commits are 630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 (v11) and ef60adc837d9d5107af21285f01e83dea309bd0a (v10). The vendor advisory explicitly states no known workarounds exist. As a temporary compensating control for applications unable to patch immediately, implement server-side or application-layer validation that rejects XY chart definitions where the x-axis range start and end values are equal before passing input to the renderer - note that this requires custom parsing logic and is not a reliable substitute for patching. Alternatively, disable or sandbox xychart diagram rendering entirely if it is not required.