Immutable.js vulnerabilities

Immutable.js prior to versions 3.8.3, 4.3.7, and 5.1.5 is vulnerable to Prototype Pollution via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

In Immutable.js versions prior to 4.3.9 and 5.1.8, a vulnerability exists in List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn. Mishandling of an index or size in the range 2**30 to 2**31 in setListBounds in src/List.js can cause an uncatchable infinite loop, unbounded memory allocation, or silent wrapping of large values.

In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.