CVE-2026-59880
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.
Risk Assessment
The risk is a potential Denial of Service (DoS) attack through deliberate hash collisions, which can significantly slow down or overload applications using the vulnerable version of Immutable.js.
Recommendation
Immediately update the Immutable.js library to version 4.3.9 or 5.1.8 (or later), which contain the fix for this vulnerability.
Other vulnerabilities in Immutable.js
See all- CVE-2026-29063Critical
Immutable.js prior to versions 3.8.3, 4.3.7, and 5.1.5 is vulnerable to Prototype Pollution via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.
- CVE-2026-59879High
In Immutable.js versions prior to 4.3.9 and 5.1.8, a vulnerability exists in List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn. Mishandling of an index or size in the range 2**30 to 2**31 in setListBounds in src/List.js can cause an uncatchable infinite loop, unbounded memory allocation, or silent wrapping of large values.
Original NVD description (English source)
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.