Mermaid is a JavaScript graphing library that parses markdown‑like text to create diagrams. The flaw resides in the setXAxisRangeData function used by XY Charts. When the function receives an invalid X‑Axis configuration, it enters an infinite loop that repeatedly appends elements to an array. After only a few iterations this can trigger a RangeError or exhaust available memory, leading the page or the JavaScript process to crash. The result is a denial of service that affects any environment that renders Mermaid diagrams with such X‑Axis parameters.

The vulnerability impacts Mermaid versions 10.6.0 through 10.9.8 as well as 11.16.1. Any application, website, or tool that embeds Mermaid to render XY Charts using these versions is exposed. Updating to version 10.9.8 or later (including 11.16.1) eliminates the issue.

The CVSS score of 5.3 denotes medium severity, and the EPSS score is not available, so current exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. An attacker must supply or force Mermaid to parse a diagram that specifies an invalid X‑Axis range. In such a scenario the infinite loop and subsequent memory exhaustion can be triggered, causing the rendering page or node process to terminate, which provides a straightforward denial‑of‑service vector.