Is CVE-2026-41150 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41150 being exploited in the wild.

How severe is CVE-2026-41150?

Medium severity, with a CVSS score of 5.3, published 29 May 2026.

Which products and versions are affected?

mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.

Is there a fix for CVE-2026-41150?

Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41150 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41150?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41150: Mermaid infinite loop denial of service in Gantt charts

CVE-2026-41150 · Severity: medium · CVSS 5.3 · Published 2026-05-29

Mermaid, a popular library used to generate diagrams and charts from text, is vulnerable to a denial-of-service attack. By providing a specifically crafted Gantt chart definition that excludes all possible dates, an attacker can cause the software to enter an infinite loop. This results in the application becoming unresponsive, potentially crashing the browser or server process responsible for rendering the diagram.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-41150 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41150 being exploited in the wild.
How severe is CVE-2026-41150?: Medium severity, with a CVSS score of 5.3, published 29 May 2026.
Which products and versions are affected?: mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.
Is there a fix for CVE-2026-41150?: Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41150 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41150?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.15.0 or later
```
npm install mermaid@11.15.0
```

Technical details

A vulnerability in Mermaid's Gantt chart rendering component allows for a denial-of-service via an infinite loop (CWE-835). The issue occurs when the 'excludes' attribute in a Gantt chart definition is set to exclude all days of the week (e.g., excluding Monday through Sunday), causing the date calculation logic in 'ganttDb.getTasks()' to loop indefinitely while searching for a valid date. This can be triggered during diagram rendering even if 'mermaid.parse' initially succeeds. The vulnerability is patched in versions 11.15.0 and 10.9.6.

Affected products

mermaid-js mermaid <= 10.9.5, >= 11.0.0-alpha.1, <= 11.14.0

Identifiers

CVE-2026-41150
GHSA-6m6c-36f7-fhxh

Timeline

2026-05-11: disclosed
2026-05-11: advisory
2026-05-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.