NPM · AUGUST 2026 · EARLY WARNING

Mermaid npm Package Vulnerability: Prototype Pollution Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
mermaid (npm)
Affected versions
>= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6
Patched version
11.16.1
GHSA-3RRR-JR9J-H3Q3

An early warning has been issued for a high severity vulnerability in the Mermaid npm package. The vulnerability, which is under investigation, involves prototype pollution when rendering untrusted architecture-beta diagrams.

What happened

The Mermaid npm package is reportedly vulnerable to prototype pollution when rendering untrusted architecture-beta diagrams. This vulnerability can lead to corrupted option and configuration defaults and logic corruption in the embedding application. The vulnerability is tracked under GHSA-3RRR-JR9J-H3Q3 and was first flagged on 2026-08-06T19:51:59+00:00. The affected versions include >= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6.

The vulnerability has not been exploited in the wild as per the current information. It is recommended to update to Mermaid v11.16.1 or later to mitigate the risk. The primary source for this advisory is the GitHub Security Advisory GHSA-3rrr-jr9j-h3q3.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If mermaid is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Mermaid npm package versions >= 10.6.0, < 10.9.8 or >= 11.0.0-alpha.1, < 11.16.1 or >= 11.5.0, < 11.16.1 or < 8.11.0 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.10.0 or >= 10.9.0-rc.1, < 10.9.4 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or >= 11.1.0, < 11.10.0 or >= 11.0.0-alpha.1, < 11.16.1 or < 10.9.8 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6 or < 10.9.3 or < 8.13.8 or >= 11.6.0, < 11.16.1 or < 8.2.3 or >= 8.0.0, < 9.1.2 or >= 11.0.0-alpha.1, < 11.15.0 or < 10.9.6.

What should I do right now?

Update to Mermaid v11.16.1 or later to mitigate the risk of prototype pollution.

Where can I find more information?

Consult the primary source at https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3 for more information.

Sources

Join the 0Day waitlist →

← Back to all threats