CVE-2026-29063

CriticalCVSS 9.8

Published: 06/03/2026(UTC)Updated: 24/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

59th percentile - higher than 59% of all known CVEs

Summary

Immutable.js prior to versions 3.8.3, 4.3.7, and 5.1.5 is vulnerable to Prototype Pollution via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

Risk Assessment

An attacker can manipulate object prototypes, potentially leading to code execution in the browser or Node.js server.

Recommendation

Upgrade Immutable.js to version 3.8.3, 4.3.7, or 5.1.5.

Original NVD description (English source)

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.