CVE-2026-71436

Mermaid XY Charts are vulnerable to an infinite loop DoS

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid parameters. Because each loop iteration appends an element to an array, this generally causes a RangeError to appear after a few seconds, but it may instead cause the page or JavaScript process to crash from memory exhaustion, depending on the environment. This issue is fixed in versions 10.9.8 and 11.16.1.

We have discovered 403 live websites that are affected by CVE-2026-71436.

Run a Free Instant Scan



Affected Software

Product  mermaid
Category Charting
Vulnerable Domains403 live websites (35% of mermaid install base)
Vulnerable Versions
  • from 10.6 through 10.9.8
  • from 11 through 11.16.1
Vulnerable Versions Count26 versions ( 33% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Aug 6, 2026
  • Updated - Aug 7, 2026

Website Distribution by Country

Number of websites using CVE-2026-71436
United States248 websites


China39 websites
Germany14 websites
France12 websites
Japan12 websites
Singapore11 websites
Russia7 websites
Cyprus6 websites
India6 websites
GB5 websites

Website Distribution by TLD

Number of websites using CVE-2026-71436
.com186 websites
.org26 websites
.net24 websites
.io18 websites
.cn13 websites
.fr10 websites
.it5 websites
.info5 websites
.de4 websites
.co.uk3 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-71436

Top websites that are affected by CVE-2026-71436. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.com United States**
******.org Sweden**,***
**********.**.org United States**,***
***.vin Austria***,***
*****.org GB***,***
****.************.org United States***,***
******.dev United States***,***
**********.org United States***,***
*******.com Austria***,***
*********.***.edu United States***,***
See full domain list

FAQ

CVE-2026-71436 is Loop with Unreachable Exit Condition ('Infinite Loop') in mermaid
A total of 403 websites have been identified as vulnerable to CVE-2026-71436, based on global website indexing conducted by WebTechSurvey.
The mermaid is affected by the CVE-2026-71436 vulnerability.
mermaid versions up to 11.16.1 are vulnerable to CVE-2026-71436.
CVE-2026-71436 is resolved in version 11.16.1 of mermaid.