CVE-2026-71439: 
JavaScript 脆弱性の分析と軽減

CVE-2026-71439 is a Denial of Service (DoS) vulnerability in the Mermaid JavaScript diagramming library, specifically affecting Radar Diagram rendering. The flaw allows an attacker to supply arbitrarily large values for the ticks parameter in radar diagrams, causing excessive CPU consumption and potential memory exhaustion that can freeze the rendering webpage or JavaScript process. It affects mermaid npm package versions >= 11.6.0 and < 11.16.1. The vulnerability was published on August 6, 2026, with a CVSS v4 base score of 5.3 (Medium) (Github Advisory).

The root cause is classified under CWE-606 (Unchecked Input for Loop Condition) and CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context). Mermaid's radar diagram parser did not validate or cap the ticks parameter before using it to drive rendering loops; because JavaScript is single-threaded, an extremely large tick count (e.g., ticks 1000000000) blocks the event loop entirely, preventing any other processing. The fix, applied in commit 59b22fa, caps the maximum allowed ticks at 32 and emits a warning if the supplied value exceeds this limit. A proof-of-concept was included in the advisory: a minimal radar diagram with ticks 1000000000 is sufficient to trigger the condition (Github Advisory, Fix Commit).

Successful exploitation causes high CPU usage and can freeze or crash the browser tab or Node.js process rendering the diagram, resulting in a denial of service for affected users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In contexts where Mermaid is used server-side (e.g., documentation generators or CI pipelines), a malicious diagram input could exhaust server resources and affect service availability for other users (Github Advisory).

A public proof-of-concept is included in the official security advisory, making exploitation trivial — an attacker only needs to craft a radar diagram with an extremely large ticks value and have a victim render it. Exploitation requires passive user interaction (a user or automated process must render the malicious diagram), and no privileges are required. The EPSS score is 0.0, indicating low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. No in-the-wild exploitation or threat actor attribution has been reported (Github Advisory).

1. Craft malicious diagram: Create a Mermaid radar diagram with an arbitrarily large ticks value, for example:

radar-beta
axis a, b
curve c {1, 1}
ticks 1000000000

2. Deliver to target: Embed the malicious diagram in any content that will be rendered by a vulnerable Mermaid instance (e.g., a Markdown document, wiki page, documentation site, or chat platform supporting Mermaid diagrams).
3. Trigger rendering: Cause a victim user or automated process (e.g., a documentation build pipeline) to render the diagram using a vulnerable version of mermaid (>= 11.6.0, < 11.16.1).
4. Achieve DoS: The JavaScript event loop is blocked by the excessive rendering loop, freezing the browser tab or Node.js process, potentially until the process is killed due to out-of-memory conditions (Github Advisory).

• Process: Browser tab or Node.js process consuming 100% CPU for an extended period while rendering a Mermaid diagram; process eventually killed due to OOM.
• Logs: Application or build pipeline logs showing timeouts or OOM errors during Mermaid diagram rendering; Node.js crash reports referencing the mermaid radar diagram renderer.
• File System: Presence of Mermaid diagram source files containing ticks values significantly above 32 (e.g., ticks 1000000000) in user-supplied content or documentation repositories.

Upgrade the mermaid npm package to version 11.16.1 or later, which caps the ticks parameter at a maximum of 32 and logs a warning if a higher value is supplied. The fix was introduced in commit 59b22fa and released as part of mermaid v11.16.1. There are no known workarounds for users who cannot upgrade — the advisory explicitly states that updating to the patched version is the only remediation (Github Advisory, Release Notes).