CVE-2026-59879: Immutable.js List Operations Buffer Overflow and Denial of Service

Technical summary

The vulnerability resides in the setListBounds function within src/List.js. List#set, List#setSize, List#setIn, List#updateIn, and their functional equivalents fail to properly validate or handle index and size parameters in the range [2^30, 2^31). For empty lists, this causes an uncatchable infinite loop. For populated lists, the mishandling triggers unbounded memory allocation, leading to out-of-memory process termination. Additionally, setSize with large values can silently wrap indices, producing logically incorrect data structures without throwing an error. The root cause stems from boundary checking that does not account for the full range of JavaScript's 32-bit signed integer space in this context.

Business impact

Applications using Immutable.js face two primary risks: denial of service through process crashes or hangs, and silent data corruption. Any service accepting user input that influences list indices—such as API parameters, database queries, or configuration values—could be exploited to crash or degrade availability. In data-intensive applications (analytics, real-time processing, financial systems), silent wrapping of large indices could lead to subtle logic errors, incorrect calculations, or compliance violations if data integrity is not validated at higher layers. The lack of an exception makes detection difficult without explicit monitoring.

Affected systems

The vulnerability affects Immutable.js (immutable package on npm) versions prior to 4.3.9 in the 4.x branch and prior to 5.1.8 in the 5.x branch. Any JavaScript/Node.js application with a transitive or direct dependency on vulnerable versions is at risk. This includes frontend applications bundled with Immutable.js, backend Node.js services, and server-side rendering frameworks. The scope is wide given Immutable.js's adoption in state management libraries and data processing pipelines.

Exploitability

Exploiting this vulnerability requires the attacker to control or influence the index or size parameter passed to affected List methods. In most realistic scenarios, this demands either direct API access or the ability to submit crafted requests that manipulate list operations. The attack surface depends on application design: if indices are derived from user input (query parameters, file uploads, API payloads), exploitation is straightforward and requires no authentication. The CVSS score of 7.5 reflects the low complexity and lack of privileges required, balanced against the absence of direct confidentiality or integrity impact. However, the availability impact is severe, making this a practical threat to uptime.

Remediation

Upgrade Immutable.js to version 4.3.9 or later if using the 4.x series, or to version 5.1.8 or later if using the 5.x series. Both releases include fixes to setListBounds that properly handle large indices and sizes. Review your dependency tree to identify all direct and transitive dependencies on Immutable.js, and plan upgrades as part of your normal patching cycle. Temporarily, consider implementing application-level validation to reject list operations with indices exceeding a safe threshold (e.g., 2^20 or lower), though this is not a substitute for patching.

Patch guidance

Apply the update during your next scheduled release or maintenance window. The patch is non-breaking within each major version series. Test the upgrade in a staging environment, particularly any code paths that manipulate large lists or that accept external input for index parameters. Monitor application logs and metrics for any behavioral changes in list operations post-upgrade. If you maintain an internal npm registry or monorepo, ensure the lock files and version constraints are updated across all dependent packages.

Detection guidance

Monitor application process metrics for sudden CPU spikes, memory exhaustion, or unexpected process terminations correlated with list operations. Log or alert on List#set, List#setSize, List#setIn, and List#updateIn calls with indices or sizes in the range [2^30, 2^31). In staging, add instrumentation to detect infinite loops or unbounded allocations by measuring execution time and memory delta for these operations. Audit your codebase for any user-controlled inputs that flow into list index parameters—these are the primary attack vectors. Static analysis tools can flag suspicious patterns in Immutable.js usage.

Why prioritize this

Although this vulnerability does not yet appear in CISA's Known Exploited Vulnerabilities catalog, the availability impact and ease of exploitation warrant prompt attention. Any application exposing Immutable.js-dependent functionality to untrusted input should be prioritized for patching. For internal tools or backend services with restricted input sources, the timeline can be longer. Organizations using Immutable.js in critical data pipelines should prioritize this as high urgency due to the risk of silent data corruption.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N, UI:N), and high availability impact (A:H). The score appropriately captures the denial-of-service severity. The scoring deliberately does not penalize confidentiality or integrity because the primary disclosed impacts are availability and logic errors; however, organizations should recognize that silent data corruption (the setSize wrapping) represents a secondary integrity risk that may not be fully reflected in the availability-focused CVSS metric.

Frequently asked questions