immutable-js immutable-js
3 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59879 | >= 5.0.0-beta.1, < 5.1.8 ; < 4.3.9 | Immutable.js `List` 32-bit trie overflow → unrecoverable DoS | HIGH 8.7 | 0.6 % | ||
| CVE-2026-59880 | < 4.3.9 ; >= 5.0.0-beta.1, < 5.1.8 | Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set | HIGH 8.7 | 0.7 % | ||
| CVE-2026-29063 | < 3.8.3 ; < 4.3.7 ; < 5.1.5 | Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable | HIGH 8.7 | 1.0 % |