CVE-2026-59880

HighCVSS 7.5/10Last modified Jul 10, 2026

Description

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

Vendor	Product	Versions
immutable-js	immutable-js	< 4.3.9; >= 5.0.0-beta.1, < 5.1.8

References

https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527bPatch
https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0fPatch
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9Release Notes
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8Release Notes
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9rExploit, Mitigation, Vendor Advisory
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9rExploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 8, 2026
Last modified: Jul 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-598816.9AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompress CVE-2026-598826.5guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host comp CVE-2026-598836.1Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain val CVE-2026-598847.5pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accu CVE-2026-598857.5pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID valu CVE-2026-598867.5pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Pytho CVE-2026-598877.5linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match CVE-2026-598886.5jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8 CVE-2026-598896.5jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9 CVE-2026-59898.8A flaw has been found in Tenda F451 1.0.0.7. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulat CVE-2026-598906.1setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList app CVE-2026-598919.6sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials