CVE-2026-59879
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Immutable.js versions prior to 4.3.9 and 5.1.8, a vulnerability exists in List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn. Mishandling of an index or size in the range 2**30 to 2**31 in setListBounds in src/List.js can cause an uncatchable infinite loop, unbounded memory allocation, or silent wrapping of large values.
Risk Assessment
An attacker could exploit this vulnerability to cause a process crash (denial of service) or exhaust system resources, threatening the availability of applications using the vulnerable library version.
Recommendation
Immediately update Immutable.js to version 4.3.9 or 5.1.8, which contain the fix for this vulnerability.
Other vulnerabilities in Immutable.js
See all- CVE-2026-29063Critical
Immutable.js prior to versions 3.8.3, 4.3.7, and 5.1.5 is vulnerable to Prototype Pollution via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.
- CVE-2026-59880High
In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.
Original NVD description (English source)
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.