Mermaid npm Package Vulnerability: Prototype Pollution Risk
- Severity
- HIGH
- Affected component
- mermaid (npm)
- Affected versions
- >= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6
- Patched version
- 11.16.1
An early warning has been issued for a high severity vulnerability in the Mermaid npm package. The vulnerability, which is under investigation, involves prototype pollution when rendering untrusted architecture-beta diagrams.
What happened
The Mermaid npm package is reportedly vulnerable to prototype pollution when rendering untrusted architecture-beta diagrams. This vulnerability can lead to corrupted option and configuration defaults and logic corruption in the embedding application. The vulnerability is tracked under GHSA-3RRR-JR9J-H3Q3 and was first flagged on 2026-08-06T19:51:59+00:00. The affected versions include >= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6.
The vulnerability has not been exploited in the wild as per the current information. It is recommended to update to Mermaid v11.16.1 or later to mitigate the risk. The primary source for this advisory is the GitHub Security Advisory GHSA-3rrr-jr9j-h3q3.
What to do about it
- Check your project dependencies for any affected versions of the Mermaid npm package.
- Update to Mermaid v11.16.1 or later to mitigate the risk of prototype pollution.
- Review your application logic and configuration defaults to ensure they are not affected by the vulnerability.
- Monitor the primary sources for any updates or additional information regarding the vulnerability.
How 0Day would have caught this
mermaid is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Mermaid npm package versions >= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6.
What should I do right now?
Update to Mermaid v11.16.1 or later to mitigate the risk of prototype pollution.
Where can I find more information?
Consult the primary source at https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3 for more information.