| Name | CVE-2026-59879 |
| Description | Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1141821 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| node-immutable (PTS) | bullseye | 3.8.2+dfsg-3 | vulnerable |
| bookworm | 4.1.0-3 | vulnerable | |
| trixie | 4.3.4-1 | vulnerable | |
| forky, sid | 4.3.8-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| node-immutable | source | (unstable) | (unfixed) | 1141821 |
[trixie] - node-immutable <no-dsa> (Minor issue)
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735
Fixed by: https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a (v4.3.9)
Fixed by: https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84 (v5.1.8)