Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there is a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates. mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram). This vulnerability is fixed in 10.9.6 and 11.15.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Mermaid, Denial of Service (DoS), #CVE-2026-41150 (Moderate Severity) https://dailycve.com/mermaid-denial-of-service-dos-cve-2026-41150-moderate-severity/
Post summary
The tweet announces a moderate‑severity DoS vulnerability (CVE‑2026‑41150) and links to a dailyCVE article, but provides no PoC, exploit, patch, or active‑exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mermaid_project | mermaid | - | node.js | - |