GCVE - cpe:2.3:a:immutable-js:immutable-js:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:immutable-js:immutable-js:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Immutable Js (`342980e6-3a51-5613-857b-14157d0d6b4b`)
Product	Immutable Js (`dc865e9d-5e8b-5e51-b6e0-2e04ec54b9ed`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-59880`	vulnerable	2026-07-29 01:03:18.033014	Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8. Published: 2026-07-08T15:44:23.414Z Updated: 2026-07-08T16:13:46.106Z Open on db.gcve.eu Reference links https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9 https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-59879`	vulnerable	2026-07-29 01:03:18.032699	Immutable.js `List` 32-bit trie overflow → unrecoverable DoS Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 30 to 2 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8. Published: 2026-07-08T15:47:24.885Z Updated: 2026-07-08T19:41:12.330Z Open on db.gcve.eu Reference links https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735 https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84 https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9 https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-29063`	vulnerable	2026-06-08 07:55:16.061266	Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5. Published: 2026-03-06T18:25:22.438Z Updated: 2026-09-10T12:05:01.255Z Open on db.gcve.eu Reference links https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.