PT-2026-56498 · Immutable Js · Immutable-Js

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59879

Mitre

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

Fix

Integer Overflow

Resource Exhaustion

Infinite Loop

Weakness Enumeration

CWE-190

CWE-400

CWE-835

CWE-1284

Related Identifiers

CVE-2026-59879

Affected Products

Immutable-Js

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-59879 · Security Note
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735 · Note
• https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8 · Note
• https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84 · Note
• https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a · Note
• https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9 · Note