Hi,

The following vulnerabilities were published for node-mermaid.

CVE-2026-50159[0]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1,
| Mermaid is vulnerable to CSS injection via sibling combinator
| selectors generated from diagram-supplied class or id names. An
| attacker who can supply diagram text can inject arbitrary CSS into
| the rendered page, potentially altering the appearance or behavior
| of unrelated page elements. This issue is fixed in versions 10.9.8
| and 11.16.1.


CVE-2026-71436[1]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. From version 10.6.0 until
| 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite
| loop denial of service in the setXAxisRangeData function when
| configuring an X-Axis with invalid parameters. Because each loop
| iteration appends an element to an array, this generally causes a
| RangeError to appear after a few seconds, but it may instead cause
| the page or JavaScript process to crash from memory exhaustion,
| depending on the environment. This issue is fixed in versions 10.9.8
| and 11.16.1.


CVE-2026-71437[2]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. From version 11.5.0 until
| 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype
| pollution when a diagram defines a group with an id of __proto__.
| Because the group id is used directly as an object property key
| without validation, an attacker who can supply diagram text can
| pollute Object.prototype, potentially affecting the behavior of the
| embedding application. This issue is fixed in version 11.16.1.


CVE-2026-71438[3]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1,
| Mermaid's configuration setters (mermaid.initialize,
| mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge caller-
| supplied configuration into Mermaid's internal config using the
| assignWithDepth deep-merge helper, which is vulnerable to prototype
| pollution. This is only exploitable if an application forwards
| untrusted data directly into one of these configuration entry
| points, which is outside their documented usage; diagram-supplied
| configuration (e.g. %%{init: {}}%% or YAML frontmatter) is not
| affected. This issue is fixed in versions 10.9.8 and 11.16.1.


CVE-2026-71439[4]:
| Mermaid is a JavaScript tool that uses Markdown-inspired text to
| create and modify diagrams and charts. From version 11.6.0 until
| 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the
| ticks parameter, which can cause high CPU usage and freeze the
| rendering webpage or JavaScript process for long periods of time,
| potentially until the process is killed from memory exhaustion. This
| issue is fixed in version 11.16.1.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-50159
https://www.cve.org/CVERecord?id=CVE-2026-50159
[1] https://security-tracker.debian.org/tracker/CVE-2026-71436
https://www.cve.org/CVERecord?id=CVE-2026-71436
[2] https://security-tracker.debian.org/tracker/CVE-2026-71437
https://www.cve.org/CVERecord?id=CVE-2026-71437
[3] https://security-tracker.debian.org/tracker/CVE-2026-71438
https://www.cve.org/CVERecord?id=CVE-2026-71438
[4] https://security-tracker.debian.org/tracker/CVE-2026-71439
https://www.cve.org/CVERecord?id=CVE-2026-71439

Regards,
Salvatore