# CVE-2026-41150: Mermaid infinite loop denial of service in Gantt charts

Source: https://junglewise.ai/threats/cve-2026-41150-mermaid-infinite-loop-denial-of-service-in-gantt-charts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-41150 · Severity: medium · CVSS 5.3 · Published 2026-05-29

Mermaid, a popular library used to generate diagrams and charts from text, is vulnerable to a denial-of-service attack. By providing a specifically crafted Gantt chart definition that excludes all possible dates, an attacker can cause the software to enter an infinite loop. This results in the application becoming unresponsive, potentially crashing the browser or server process responsible for rendering the diagram.

Technologies: [mermaid (npm)](https://junglewise.ai/threats/technologies/mermaid). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41150 being exploited in the wild.

**How severe is CVE-2026-41150?** Medium severity, with a CVSS score of 5.3, published 29 May 2026.

**Which products and versions are affected?** mermaid (npm) SEMVER:introduced=11.0.0-alpha.1,fixed=11.15.0.

**Is there a fix for CVE-2026-41150?** Yes. mermaid (npm): upgrade to 11.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41150 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41150?** Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mermaid (npm): upgrade to 11.15.0 or later

  ```sh
  npm install mermaid@11.15.0
  ```


## Technical details

A vulnerability in Mermaid's Gantt chart rendering component allows for a denial-of-service via an infinite loop (CWE-835). The issue occurs when the 'excludes' attribute in a Gantt chart definition is set to exclude all days of the week (e.g., excluding Monday through Sunday), causing the date calculation logic in 'ganttDb.getTasks()' to loop indefinitely while searching for a valid date. This can be triggered during diagram rendering even if 'mermaid.parse' initially succeeds. The vulnerability is patched in versions 11.15.0 and 10.9.6.

## Affected products

- mermaid-js mermaid <= 10.9.5, >= 11.0.0-alpha.1, <= 11.14.0

## Identifiers

- CVE-2026-41150
- GHSA-6m6c-36f7-fhxh

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched

## References

- [https://api.github.com/users/aloisklink](https://api.github.com/users/aloisklink)
- [https://github.com/aloisklink](https://github.com/aloisklink)
- [https://api.github.com/users/aloisklink/gists%7B/gist_id%7D](https://api.github.com/users/aloisklink/gists%7B/gist_id%7D)
- [https://api.github.com/users/aloisklink/repos](https://api.github.com/users/aloisklink/repos)
- [https://avatars.githubusercontent.com/u/19716675?v=4](https://avatars.githubusercontent.com/u/19716675?v=4)
- [https://api.github.com/users/aloisklink/events%7B/privacy%7D](https://api.github.com/users/aloisklink/events%7B/privacy%7D)

## Related threats

- [Mermaid radar diagrams denial of service via unchecked ticks input](https://junglewise.ai/threats/cve-2026-71439-mermaid-radar-diagrams-denial-of-service-via-unchecked-ticks)
- [Mermaid prototype pollution in configuration APIs](https://junglewise.ai/threats/cve-2026-71438-mermaid-prototype-pollution-in-configuration-apis)
- [Mermaid prototype pollution in architecture-beta diagrams](https://junglewise.ai/threats/cve-2026-71437-mermaid-prototype-pollution-in-architecture-beta-diagrams)
- [Mermaid infinite loop in XY Charts axis processing](https://junglewise.ai/threats/cve-2026-71436-mermaid-infinite-loop-in-xy-charts-axis-processing)
- [Mermaid CSS injection via sibling combinators](https://junglewise.ai/threats/cve-2026-50159-mermaid-css-injection-via-sibling-combinators)