CVE-2026-29063
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Immutable.js prior to versions 3.8.3, 4.3.7, and 5.1.5 is vulnerable to Prototype Pollution via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.
Risk Assessment
An attacker can manipulate object prototypes, potentially leading to code execution in the browser or Node.js server.
Recommendation
Upgrade Immutable.js to version 3.8.3, 4.3.7, or 5.1.5.
Other vulnerabilities in Immutable.js
See all- CVE-2026-59879High
In Immutable.js versions prior to 4.3.9 and 5.1.8, a vulnerability exists in List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn. Mishandling of an index or size in the range 2**30 to 2**31 in setListBounds in src/List.js can cause an uncatchable infinite loop, unbounded memory allocation, or silent wrapping of large values.
- CVE-2026-59880High
In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.
Original NVD description (English source)
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS