CVE-2026-41150 Overview
CVE-2026-41150 is a denial-of-service vulnerability in Mermaid, a JavaScript library that renders diagrams and charts from Markdown-inspired text. The flaw affects gantt chart rendering when the excludes attribute is configured to exclude all dates. Processing such input triggers an infinite loop in the gantt database task generation routine, exhausting CPU resources on the rendering host or browser. The issue is tracked under [CWE-835] (Loop with Unreachable Exit Condition) and is fixed in versions 10.9.6 and 11.15.0.
Critical Impact
Untrusted Mermaid input containing a gantt chart with an excludes attribute excluding all dates causes the renderer to hang, producing a denial-of-service condition in applications that render user-supplied diagrams.
Affected Products
- Mermaid versions prior to 10.9.6
- Mermaid 11.x versions prior to 11.15.0
- Node.js and browser applications embedding the Mermaid rendering pipeline
Discovery Timeline
- 2026-05-29 - CVE-2026-41150 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-41150
Vulnerability Analysis
Mermaid converts Markdown-like syntax into rendered diagrams, including gantt charts that support date filtering via the excludes attribute. When excludes is configured so that every candidate date falls within the excluded set, the task generation loop cannot find a valid date to assign. The loop continues advancing dates without satisfying its termination condition, consuming CPU indefinitely.
The vulnerable path is reached through ganttDb.getTasks(), which the renderer invokes during diagram processing. Calling mermaid.parse alone does not trigger the condition, but any code path that proceeds to render the parsed diagram will. Applications that accept user-submitted Mermaid source, such as wikis, documentation platforms, chat clients, and note-taking tools, are exposed when they render content server-side or in a shared browser context.
Root Cause
The root cause is a missing termination guard in the gantt task scheduling logic. When all dates are excluded, the routine that increments through candidate dates lacks a bounded iteration check, satisfying the definition of [CWE-835]. The fixes in commits a59ea56 and faafb5d add validation to detect impossible scheduling configurations and exit the loop instead of iterating without progress.
Attack Vector
An attacker submits a gantt diagram whose excludes attribute covers every weekday and date in the chart range. When the target application renders the diagram, ganttDb.getTasks() enters the unterminated loop. The attacker requires no authentication and no privileges, only the ability to submit Mermaid source that the target subsequently renders. The vulnerability is described in the GitHub Security Advisory GHSA-6m6c-36f7-fhxh.
Detection Methods for CVE-2026-41150
Indicators of Compromise
- Sustained single-thread CPU saturation in Node.js processes or browser tabs rendering Mermaid content
- Application worker timeouts or unresponsive UI shortly after submission of gantt diagrams containing broad excludes clauses
- Repeated POST or PUT requests delivering gantt source with excludes directives covering all weekdays and date ranges
Detection Strategies
- Inventory dependencies with npm ls mermaid or equivalent SBOM tooling to identify versions below 10.9.6 or 11.15.0
- Inspect inbound content for gantt blocks containing excludes patterns that enumerate all weekdays or saturate the chart date range
- Add timeouts around server-side Mermaid rendering and alert when execution exceeds expected duration
Monitoring Recommendations
- Monitor process-level CPU and event-loop lag metrics on services that render user-supplied diagrams
- Log Mermaid render failures, timeouts, and worker restarts for correlation with submitted diagram source
- Track Mermaid package versions across build pipelines to flag rollbacks to vulnerable releases
How to Mitigate CVE-2026-41150
Immediate Actions Required
- Upgrade Mermaid to 10.9.6 or 11.15.0 or later in all front-end and back-end build targets
- Audit applications that render Mermaid content from untrusted sources and apply execution timeouts
- Restrict or sanitize gantt excludes input where business requirements allow
Patch Information
The fix is included in Mermaid 10.9.6 and 11.15.0. Refer to the GitHub Release Note v11.15.0 and the GitHub Release Note v10.9.6. The corrective commits are available at commit a59ea56 and commit faafb5d.
Workarounds
- Render Mermaid diagrams in a sandboxed worker with a hard execution timeout to bound CPU usage
- Reject or strip gantt excludes clauses from user-submitted diagrams until patching is complete
- Disable server-side rendering of untrusted Mermaid content and defer rendering to isolated client contexts
# Configuration example
npm install mermaid@^11.15.0
# or for the 10.x line
npm install mermaid@^10.9.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
