PT-2026-56498 · Immutable Js · Immutable-Js

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-59879

NVD

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

Exploit

Correção

Infinite Loop

Resource Exhaustion

Integer Overflow

Enumeração de Fraquezas

CWE-835

CWE-400

CWE-190

CWE-1284

Identificadores relacionados

CVE-2026-59879

Produtos afetados

Immutable-Js

Referências · 6

• 🔥 https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735 · Exploit
• https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8 · Nota
• https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84 · Nota
• https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9 · Nota
• https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-59879 · Nota de Segurança