THREAT OPS › Threat News › [GHSA] GHSA-2v8p-3f2j-5mp7 (medium) — Mermaid XY Charts are vulnerable to an infinite loop DoS
[GHSA] GHSA-2v8p-3f2j-5mp7 (medium) — Mermaid XY Charts are vulnerable to an infinite loop DoS
GHSA-2v8p-3f2j-5mp7 Severity: medium CVE: CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
### Impact
Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters.
As each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- 630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289sha1
- ef60adc837d9d5107af21285f01e83dea309bd0asha1
- CVE-2026-71436cve
Original source: https://github.com/advisories/GHSA-2v8p-3f2j-5mp7