CVE-2026-59880

NameCVE-2026-59880
DescriptionImmutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1141821

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-immutable (PTS)bullseye3.8.2+dfsg-3vulnerable
bookworm4.1.0-3vulnerable
trixie4.3.4-1vulnerable
forky, sid4.3.8-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-immutablesource(unstable)(unfixed)1141821

Notes

[trixie] - node-immutable <no-dsa> (Minor issue)
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r
Fixed by: https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b (v4.3.9)
Fixed by: https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f (v5.1.8)

Search for package or bug name: Reporting problems