Executive brief
Mermaid, a popular JavaScript-based diagramming and charting tool, is vulnerable to a denial-of-service condition when processing radar diagrams. An attacker can provide a specially crafted diagram with an extremely large number of 'ticks,' causing the user's browser or the application server to freeze and eventually crash due to excessive memory and CPU usage. This can lead to temporary service unavailability for users viewing the malicious diagram.
Technical details
A Denial of Service (DoS) vulnerability exists in Mermaid's radar diagram component due to improper validation of the 'ticks' input parameter (CWE-606). By providing an arbitrarily large integer to the 'ticks' property in a radar-beta diagram, an attacker can trigger an infinite or extremely long-running loop. This results in high CPU utilization and memory exhaustion (OOM), effectively freezing the JavaScript execution thread. The vulnerability is reachable via network-delivered diagram definitions and requires passive user interaction (viewing the diagram). The issue is patched in Mermaid v11.16.1.
Affected products
- mermaid-js mermaid >= 11.6.0, < 11.16.1
Timeline
- 2026-08-04: disclosed
- 2026-08-06: advisory
- 2026-08-06: patched