CVE-2026-41150

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.

We have discovered 1,141 live websites that are affected by CVE-2026-41150.

Run a Free Instant Scan



Affected Software

Product  mermaid
Category Charting
Vulnerable Domains1,141 live websites (99% of mermaid install base)
Vulnerable Versions
  • from 0 through 10.9.6
  • from 11 through 11.15
Vulnerable Versions Count76 versions ( 95% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - May 29, 2026
  • Updated - May 29, 2026

Website Distribution by Country

Number of websites using CVE-2026-41150
United States753 websites


China82 websites
Germany53 websites
Japan28 websites
France26 websites
Singapore25 websites
GB17 websites
Malaysia11 websites
Italy10 websites

Website Distribution by TLD

Number of websites using CVE-2026-41150
.com475 websites
.org107 websites
.net64 websites
.io58 websites
.cn38 websites
.de27 websites
.fr20 websites
.it10 websites
.info9 websites
.co.uk9 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-41150

Top websites that are affected by CVE-2026-41150. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.io United States*,***
*********.****.gov United States**,***
******.org Sweden**,***
****.******.com United States**,***
*****.org United States**,***
*********.dev United States**,***
****.org United States**,***
*****.dev United States**,***
**********.**.org United States**,***
*******.net United States**,***
See full domain list

FAQ

CVE-2026-41150 is Loop with Unreachable Exit Condition ('Infinite Loop') in mermaid
A total of 1,141 websites have been identified as vulnerable to CVE-2026-41150, based on global website indexing conducted by WebTechSurvey.
The mermaid is affected by the CVE-2026-41150 vulnerability.
mermaid versions up to 11.15 are vulnerable to CVE-2026-41150.
CVE-2026-41150 is resolved in version 11.15 of mermaid.