Is CVE-2026-71439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71439 being exploited in the wild.

How severe is CVE-2026-71439?

Medium severity, with a CVSS score of 4, published 6 August 2026.

Which products and versions are affected?

mermaid (npm) >= 11.6.0, < 11.16.1, SEMVER:introduced=11.6.0,fixed=11.16.1.

Is there a fix for CVE-2026-71439?

Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71439 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71439?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71439: Mermaid radar diagrams denial of service via unchecked ticks input

Q: Is there a fix for CVE-2026-71439?

Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-71439 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-71439?

Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71439 · Severity: medium · CVSS 4 · Published 2026-08-06

Mermaid, a popular JavaScript-based diagramming and charting tool, is vulnerable to a denial-of-service condition when processing radar diagrams. An attacker can provide a specially crafted diagram with an extremely large number of 'ticks,' causing the user's browser or the application server to freeze and eventually crash due to excessive memory and CPU usage. This can lead to temporary service unavailability for users viewing the malicious diagram.

Technologies: mermaid (npm). Vendors: npm.

Quick answers

Is CVE-2026-71439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71439 being exploited in the wild.
How severe is CVE-2026-71439?: Medium severity, with a CVSS score of 4, published 6 August 2026.
Which products and versions are affected?: mermaid (npm) >= 11.6.0, < 11.16.1, SEMVER:introduced=11.6.0,fixed=11.16.1.
Is there a fix for CVE-2026-71439?: Yes. mermaid (npm): upgrade to 11.16.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71439 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71439?: Check whether you run mermaid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mermaid (npm): upgrade to 11.16.1 or later
```
npm install mermaid@11.16.1
```

Technical details

A Denial of Service (DoS) vulnerability exists in Mermaid's radar diagram component due to improper validation of the 'ticks' input parameter (CWE-606). By providing an arbitrarily large integer to the 'ticks' property in a radar-beta diagram, an attacker can trigger an infinite or extremely long-running loop. This results in high CPU utilization and memory exhaustion (OOM), effectively freezing the JavaScript execution thread. The vulnerability is reachable via network-delivered diagram definitions and requires passive user interaction (viewing the diagram). The issue is patched in Mermaid v11.16.1.

Affected products

mermaid-js mermaid >= 11.6.0, < 11.16.1

Identifiers

CVE-2026-71439
GHSA-rhh3-jpg6-66xh

Timeline

2026-08-04: disclosed
2026-08-06: advisory
2026-08-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.