GitHub Advisoryadvisory · npm
GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
MEDIUM
Official page ↗
- Aliases
- CVE-2026-41150
- Ecosystem
- npm
- Packages
- mermaid
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-835
- Reviewed
- 2026-05-11
Affected packages
• npm mermaid: >= 11.0.0-alpha.1, < 11.15.0 → fixed in 11.15.0
• npm mermaid: < 10.9.6 → fixed in 10.9.6
Description
Impact
Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the `excludes` attribute to exclude all dates.
Example:
```
gantt
excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
DoS :2025-01-01, 1d
```
`mermaid.parse` is unaffected, unless you then call the `ganttDb.getTasks()` (which is called when rendering a diagram).
Patches
This has been patched in:
• v11.15.0 (see faafb5d49106dd32c367f3882505f2dd625aa30e)
• v10.9.6 (see a59ea56174712ee5430dfd5bc877cb5151f501a6)
Workarounds
There are no workarounds available without updating to a newer version of mermaid.
Related
Alias · CVE (1)
- CVE-2026-41150 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. vulnerability
Weakness · CWE (1)
- CWE-835 Loop with Unreachable Exit Condition weakness
References
- https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh web
- https://nvd.nist.gov/vuln/detail/CVE-2026-41150 advisory
- https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6 web
- https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e web
- https://github.com/mermaid-js/mermaid package
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 web
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6 web