CVE-2026-29063

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
References
Link Resource
https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 Release Notes
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 Release Notes
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 Release Notes
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw Exploit Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11070
https://access.redhat.com/errata/RHSA-2026:11217
https://access.redhat.com/errata/RHSA-2026:11414
https://access.redhat.com/errata/RHSA-2026:11858
https://access.redhat.com/errata/RHSA-2026:11916
https://access.redhat.com/errata/RHSA-2026:12118
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:13791
https://access.redhat.com/errata/RHSA-2026:13826
https://access.redhat.com/errata/RHSA-2026:13829
https://access.redhat.com/errata/RHSA-2026:13847
https://access.redhat.com/errata/RHSA-2026:13853
https://access.redhat.com/errata/RHSA-2026:17469
https://access.redhat.com/errata/RHSA-2026:17598
https://access.redhat.com/errata/RHSA-2026:19375
https://access.redhat.com/errata/RHSA-2026:19409
https://access.redhat.com/errata/RHSA-2026:19410
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20034
https://access.redhat.com/errata/RHSA-2026:20041
https://access.redhat.com/errata/RHSA-2026:20042
https://access.redhat.com/errata/RHSA-2026:20088
https://access.redhat.com/errata/RHSA-2026:21657
https://access.redhat.com/errata/RHSA-2026:21658
https://access.redhat.com/errata/RHSA-2026:21703
https://access.redhat.com/errata/RHSA-2026:21931
https://access.redhat.com/errata/RHSA-2026:22465
https://access.redhat.com/errata/RHSA-2026:23246
https://access.redhat.com/errata/RHSA-2026:24473
https://access.redhat.com/errata/RHSA-2026:24977
https://access.redhat.com/errata/RHSA-2026:26225
https://access.redhat.com/errata/RHSA-2026:26232
https://access.redhat.com/errata/RHSA-2026:27063
https://access.redhat.com/errata/RHSA-2026:28893
https://access.redhat.com/errata/RHSA-2026:28964
https://access.redhat.com/errata/RHSA-2026:29857
https://access.redhat.com/errata/RHSA-2026:29864
https://access.redhat.com/errata/RHSA-2026:34049
https://access.redhat.com/errata/RHSA-2026:34099
https://access.redhat.com/errata/RHSA-2026:34100
https://access.redhat.com/errata/RHSA-2026:34342
https://access.redhat.com/errata/RHSA-2026:36621
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:40022
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40984
https://access.redhat.com/errata/RHSA-2026:41928
https://access.redhat.com/errata/RHSA-2026:41941
https://access.redhat.com/errata/RHSA-2026:41944
https://access.redhat.com/errata/RHSA-2026:6428
https://access.redhat.com/errata/RHSA-2026:6568
https://access.redhat.com/errata/RHSA-2026:6720
https://access.redhat.com/errata/RHSA-2026:6926
https://access.redhat.com/errata/RHSA-2026:7329
https://access.redhat.com/errata/RHSA-2026:8218
https://access.redhat.com/errata/RHSA-2026:8483
https://access.redhat.com/errata/RHSA-2026:8484
https://access.redhat.com/errata/RHSA-2026:8490
https://access.redhat.com/errata/RHSA-2026:8491
https://access.redhat.com/errata/RHSA-2026:8493
https://access.redhat.com/errata/RHSA-2026:9742
https://access.redhat.com/errata/RHSA-2026:9848
https://access.redhat.com/security/cve/CVE-2026-29063
https://bugzilla.redhat.com/show_bug.cgi?id=2445291
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*

History

24 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40022 -

21 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:41928 -
  • () https://access.redhat.com/errata/RHSA-2026:41941 -
  • () https://access.redhat.com/errata/RHSA-2026:41944 -

17 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -

16 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36621 -
  • () https://access.redhat.com/errata/RHSA-2026:40118 -
  • () https://access.redhat.com/errata/RHSA-2026:40984 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34100 -

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34049 -
  • () https://access.redhat.com/errata/RHSA-2026:34099 -
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36882 -

02 Jul 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:28893 -
  • () https://access.redhat.com/errata/RHSA-2026:28964 -
  • () https://access.redhat.com/errata/RHSA-2026:29864 -
  • () https://access.redhat.com/errata/RHSA-2026:34342 -

01 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:29857 -

30 Jun 2026, 03:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:11070 -
  • () https://access.redhat.com/errata/RHSA-2026:11217 -
  • () https://access.redhat.com/errata/RHSA-2026:11414 -
  • () https://access.redhat.com/errata/RHSA-2026:11858 -
  • () https://access.redhat.com/errata/RHSA-2026:11916 -
  • () https://access.redhat.com/errata/RHSA-2026:12118 -
  • () https://access.redhat.com/errata/RHSA-2026:13542 -
  • () https://access.redhat.com/errata/RHSA-2026:13548 -
  • () https://access.redhat.com/errata/RHSA-2026:13791 -
  • () https://access.redhat.com/errata/RHSA-2026:13826 -
  • () https://access.redhat.com/errata/RHSA-2026:13829 -
  • () https://access.redhat.com/errata/RHSA-2026:13847 -
  • () https://access.redhat.com/errata/RHSA-2026:13853 -
  • () https://access.redhat.com/errata/RHSA-2026:17469 -
  • () https://access.redhat.com/errata/RHSA-2026:17598 -
  • () https://access.redhat.com/errata/RHSA-2026:19375 -
  • () https://access.redhat.com/errata/RHSA-2026:19409 -
  • () https://access.redhat.com/errata/RHSA-2026:19410 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:20034 -
  • () https://access.redhat.com/errata/RHSA-2026:20041 -
  • () https://access.redhat.com/errata/RHSA-2026:20042 -
  • () https://access.redhat.com/errata/RHSA-2026:20088 -
  • () https://access.redhat.com/errata/RHSA-2026:21657 -
  • () https://access.redhat.com/errata/RHSA-2026:21658 -
  • () https://access.redhat.com/errata/RHSA-2026:21703 -
  • () https://access.redhat.com/errata/RHSA-2026:21931 -
  • () https://access.redhat.com/errata/RHSA-2026:22465 -
  • () https://access.redhat.com/errata/RHSA-2026:23246 -
  • () https://access.redhat.com/errata/RHSA-2026:24473 -
  • () https://access.redhat.com/errata/RHSA-2026:24977 -
  • () https://access.redhat.com/errata/RHSA-2026:26225 -
  • () https://access.redhat.com/errata/RHSA-2026:26232 -
  • () https://access.redhat.com/errata/RHSA-2026:27063 -
  • () https://access.redhat.com/errata/RHSA-2026:6428 -
  • () https://access.redhat.com/errata/RHSA-2026:6568 -
  • () https://access.redhat.com/errata/RHSA-2026:6720 -
  • () https://access.redhat.com/errata/RHSA-2026:6926 -
  • () https://access.redhat.com/errata/RHSA-2026:7329 -
  • () https://access.redhat.com/errata/RHSA-2026:8218 -
  • () https://access.redhat.com/errata/RHSA-2026:8483 -
  • () https://access.redhat.com/errata/RHSA-2026:8484 -
  • () https://access.redhat.com/errata/RHSA-2026:8490 -
  • () https://access.redhat.com/errata/RHSA-2026:8491 -
  • () https://access.redhat.com/errata/RHSA-2026:8493 -
  • () https://access.redhat.com/errata/RHSA-2026:9742 -
  • () https://access.redhat.com/errata/RHSA-2026:9848 -
  • () https://access.redhat.com/security/cve/CVE-2026-29063 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2445291 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json -
CWE CWE-915

17 Apr 2026, 21:32

Type Values Removed Values Added
CPE cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
First Time Immutable-js
Immutable-js immutable
Summary
  • (es) Immutable.js proporciona muchas estructuras de datos inmutables persistentes. Antes de las versiones 3.8.3, 4.3.7 y 5.1.5, la contaminación de prototipos es posible en immutable a través de las APIs mergeDeep(), mergeDeepWith(), merge(), Map.toJS() y Map.toObject(). Este problema ha sido parcheado en las versiones 3.8.3, 4.3.7 y 5.1.5.
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References () https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 - () https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 - Release Notes
References () https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 - () https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 - Release Notes
References () https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 - () https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 - Release Notes
References () https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw - () https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw - Exploit, Vendor Advisory

06 Mar 2026, 19:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-03-06 19:16

Updated : 2026-07-24 13:17


NVD link : CVE-2026-29063

Mitre link : CVE-2026-29063

CVE.ORG link : CVE-2026-29063


JSON object : View

Products Affected

immutable-js

  • immutable
CWE
CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes