CVE-2026-41150: Mermaid infinite loop denial of service in Gantt charts

Executive brief

Mermaid, a popular library used to generate diagrams and charts from text, is vulnerable to a denial-of-service attack. By providing a specifically crafted Gantt chart definition that excludes all possible dates, an attacker can cause the software to enter an infinite loop. This results in the application becoming unresponsive, potentially crashing the browser or server process responsible for rendering the diagram.

Technical details

A vulnerability in Mermaid's Gantt chart rendering component allows for a denial-of-service via an infinite loop (CWE-835). The issue occurs when the 'excludes' attribute in a Gantt chart definition is set to exclude all days of the week (e.g., excluding Monday through Sunday), causing the date calculation logic in 'ganttDb.getTasks()' to loop indefinitely while searching for a valid date. This can be triggered during diagram rendering even if 'mermaid.parse' initially succeeds. The vulnerability is patched in versions 11.15.0 and 10.9.6.

Affected products

• mermaid-js mermaid <= 10.9.5, >= 11.0.0-alpha.1, <= 11.14.0

Timeline

• 2026-05-11: disclosed
• 2026-05-11: advisory
• 2026-05-11: patched

References

• https://api.github.com/users/aloisklink
• https://github.com/aloisklink
• https://api.github.com/users/aloisklink/gists%7B/gist_id%7D
• https://api.github.com/users/aloisklink/repos
• https://avatars.githubusercontent.com/u/19716675?v=4
• https://api.github.com/users/aloisklink/events%7B/privacy%7D