Executive brief
Mermaid is a popular JavaScript library for generating diagrams from text. Its XY Chart feature is vulnerable to a denial-of-service attack when processing malformed axis configuration. An attacker can craft a specially-formatted diagram that causes the application to enter an infinite loop, consuming memory until the process crashes or becomes unresponsive, disrupting service availability for all users.
Technical details
The vulnerability exists in Mermaid's XY Chart rendering component, specifically in the setXAxisRangeData() function. When an X-axis is configured with invalid parameters (e.g., a zero-width range such as "1 --> 1"), the function enters an infinite loop that continuously appends elements to an array without a valid exit condition (CWE-835). Each iteration allocates memory, eventually causing a RangeError: Invalid array length or triggering garbage collection failures, leading to out-of-memory crashes. The vulnerability is triggered client-side when a user views a malicious diagram, requiring only passive user interaction (viewing a page). No authentication or elevated privileges are required. The attack vector is network-based; an attacker can embed the malicious diagram syntax in a web application or document. Patches have been released in Mermaid v11.16.1 (main branch) and v10.9.8 (v10 branch), implementing proper bounds checking and support for zero-width x-axis ranges.
Affected products
- mermaid-js mermaid >=10.6.0, <=10.9.7; >=11.0.0-alpha.1, <=11.16.0
Timeline
- 2026-08-06: disclosed
- 2026-08-06: patched: Patched in v11.16.1 and v10.9.8
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
- https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8