Mermaid radar diagrams are vulnerable to DoS
Impact
Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.
Proof-of-concept
radar-beta
axis a, b
curve c {1, 1}
ticks 1000000000Patches
Has the problem been patched? What versions should users upgrade to?
This problem has been patched by https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e, which was released in Mermaid v11.16.1
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
There are no known workarounds without updating to a patched version of mermaid.
References
Are there any links users can visit to find out more?
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | mermaid | >= 11.6.0, < 11.16.1 | 11.16.1 |
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh
- https://github.com/mermaid-js/mermaid/pull/8022
- https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e
- https://github.com/mermaid-js/mermaid
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L- Weakness (CWE)
CWE-1322, CWE-606- Platform
- npm
- Package
mermaid- Disclosed
- 06.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rhh3-jpg6-66xh - CC BY 4.0
Vulnerability history: mermaid
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 09.2020 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 12
- Low 1
Disclosures per year
- 2020: 1
- 2021: 1
- 2022: 2
- 2023: 0
- 2024: 1
- 2025: 2
- 2026: 9
-
Mermaid radar diagrams are vulnerable to DoS this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.