p PatchFirst

CVE-2026-29063

CVE-2026-29063 · Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS 8.7 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • immutable-js

    Versions
    • < 3.8.3: Affected
    • < 4.3.7: Affected
    • < 5.1.5: Affected

    No fix published

  • node-immutable Debian:12

    Versions
    • 4.1.0-3
    • 4.3.4-1
    • 4.3.8-1
    • 4.3.8-2
    • 4.3.9-1
    • 5.1.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Debian:13

    Versions
    • 4.3.4-1
    • 4.3.8-1
    • 4.3.8-2
    • 4.3.9-1
    • 5.1.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Debian:14

    Versions
    • 4.3.4-1
    Affected ranges
    • ECOSYSTEM: < 4.3.8-1

    Update to 4.3.8-1

  • immutable npm

    Affected ranges
    • SEMVER: ≥ 4.0.0-rc.1, < 4.3.8

    Update to 4.3.8

  • immutable npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.1.5

    Update to 5.1.5

  • immutable npm

    Affected ranges
    • SEMVER: < 3.8.3

    Update to 3.8.3

  • node-immutable Ubuntu:20.04:LTS

    Versions
    • 3.8.2+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:22.04:LTS

    Versions
    • 3.8.2+dfsg-3
    • 4.0.0-1
    • 4.0.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:24.04:LTS

    Versions
    • 4.1.0-3
    • 4.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:25.10

    Versions
    • 4.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:26.04:LTS

    Versions
    • 4.3.4-1
    • 4.3.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →