Skip to content
OpenAdvisories

Package · Debian

node-immutable

3 known vulnerabilities.

All Critical High Medium Low Exploited only

3 results · Feed

  • High 8.7
    CVE-2026-59879

    Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

    Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBoun…

    immutable-js immutable-js node-immutable immutable Debian Ubuntu npm
  • High 8.7
    CVE-2026-59880

    Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

    Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who con…

    immutable-js immutable-js immutable node-immutable Debian Ubuntu npm
  • High 8.7
    CVE-2026-29063

    Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

    Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been pa…

    immutable-js immutable-js node-immutable immutable Debian Ubuntu npm