GHSA-rhh3-jpg6-66xh: mermaid fixed in 11.16.1

GHSA-rhh3-jpg6-66xh PUBLISHED CVSS 5.300000190734863 MEDIUM

Mermaid radar diagrams are vulnerable to DoS

Record from GitHub Advisory Database · Published August 6, 2026

mermaid is fixed in 11.16.1 (npm)

Mermaid radar diagrams are vulnerable to DoS

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
mermaid	npm	11.16.1
langfuse-3	Wolfi	3.225.7-r6, 3.225.1-r2
gitlab-rails-ce-fips-19.2	Chainguard	19.2.5-r2
langfuse-3	Chainguard	3.225.1-r2
gitlab-rails-ce-18.11	Chainguard	18.11.13-r0
langfuse-fips-2	Chainguard	2.95.12-r43
langfuse-4	Chainguard	4.7.1-r0
gitlab-rails-ce-19.1	Chainguard	19.1.9-r0
langfuse-fips-3	Chainguard	3.224.3-r11
gitlab-rails-ce-fips-19.3	Chainguard	19.3.1-r3
gitlab-rails-ce-fips-19.1	Chainguard	19.1.8-r9
commercial-gitlab-rails-ee-fips-19.1	Chainguard	19.1.9-r0

10 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

5.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Affected products

Vendor	Product	Versions
wolfi	langfuse-3	0, 0
chainguard	gitlab-rails-ce-fips-19.2	0
chainguard	langfuse-3	0
npm	mermaid	11.6.0
chainguard	gitlab-rails-ce-18.11	0
chainguard	langfuse-fips-2	0
chainguard	langfuse-4	0
chainguard	gitlab-rails-ce-19.1	0
chainguard	langfuse-fips-3	0
chainguard	gitlab-rails-ce-fips-19.3	0
chainguard	gitlab-rails-ce-fips-19.1	0
chainguard	commercial-gitlab-rails-ee-fips-19.1	0
chainguard	gitlab-rails-ce-19.3	0
chainguard	gitlab-rails-ce-19.2	0
chainguard	commercial-gitlab-rails-ee-19.1	0
chainguard	langfuse-2	0
chainguard	langfuse-fips-4	0
chainguard	gitlab-rails-ce-19.0	0
wolfi	jupyter-base-notebook	0
chainguard	tensorflow-gpu-jupyter	0

…and 2 more

Timeline

Aug 6, 2026 CVE Published

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-rhh3-jpg6-66xh
vulnetix vdb fixes GHSA-rhh3-jpg6-66xh

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-rhh3-jpg6-66xh/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →