By vendor

Immutable-Js vulnerabilities

Known CVEs affecting Immutable-Js products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-59879HIGH 7.5

  Immutable.js, a popular JavaScript library for working with immutable data structures, contains a critical flaw in how it handles large array indices and sizes. When developers use certain list operations with indices between roughly 1 billion and 2 billion, the library either freezes indefinitely, consumes all available memory, or silently produces incorrect results. This affects versions before 4.3.9 and 5.1.8. The vulnerability poses a significant availability risk to any application relying on Immutable.js for core data management, particularly those processing user-controlled list operations at scale.

• CVE-2026-59880HIGH 7.5

  Immutable.js, a popular JavaScript library for managing immutable data structures, contains a denial-of-service vulnerability in versions prior to 4.3.9 and 5.1.8. An attacker can deliberately craft many keys that hash to the same value, forcing the library to perform linear scans through collision buckets during map and set operations. This causes excessive CPU consumption and can slow or crash applications that accept untrusted input for map construction or merging. The vulnerability requires no authentication and can be triggered remotely through normal API calls like Immutable.Map() or state.merge().