Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
References
Configurations
Configuration 1 (hide)
|
History
24 Jul 2026, 13:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Jul 2026, 13:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Jul 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jul 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Jul 2026, 13:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jun 2026, 03:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CWE | CWE-915 |
17 Apr 2026, 21:32
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:* | |
| First Time |
Immutable-js
Immutable-js immutable |
|
| Summary |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 - Release Notes | |
| References | () https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 - Release Notes | |
| References | () https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 - Release Notes | |
| References | () https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw - Exploit, Vendor Advisory |
06 Mar 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-06 19:16
Updated : 2026-07-24 13:17
NVD link : CVE-2026-29063
Mitre link : CVE-2026-29063
CVE.ORG link : CVE-2026-29063
JSON object : View
Products Affected
immutable-js
- immutable
