p PatchFirst

CVE-2026-59880

CVE-2026-59880 · Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.

CVSS 8.7 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • immutable-js

    Versions
    • < 4.3.9: Affected
    • >= 5.0.0-beta.1, < 5.1.8: Affected

    No fix published

  • node-immutable Debian:12

    Versions
    • 4.1.0-3
    • 4.3.4-1
    • 4.3.8-1
    • 4.3.8-2
    • 4.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Debian:13

    Versions
    • 4.3.4-1
    • 4.3.8-1
    • 4.3.8-2
    • 4.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Debian:14

    Versions
    • 4.3.4-1
    • 4.3.8-1
    • 4.3.8-2
    Affected ranges
    • ECOSYSTEM: < 4.3.9-1

    Update to 4.3.9-1

  • immutable npm

    Affected ranges
    • SEMVER: ≥ 4.0.0-beta.1, < 4.3.9

    Update to 4.3.9

  • immutable npm

    Affected ranges
    • SEMVER: ≥ 5.0.0-beta.1, < 5.1.8

    Update to 5.1.8

  • immutable npm

    Affected ranges
    • SEMVER: < 3.8.4

    Update to 3.8.4

  • node-immutable Ubuntu:20.04:LTS

    Versions
    • 3.8.2+dfsg-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:22.04:LTS

    Versions
    • 3.8.2+dfsg-3
    • 4.0.0-1
    • 4.0.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:24.04:LTS

    Versions
    • 4.1.0-3
    • 4.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:25.10

    Versions
    • 4.3.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:26.10

    Versions
    • 4.3.8-2
    • 4.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-immutable Ubuntu:26.04:LTS

    Versions
    • 4.3.4-1
    • 4.3.8-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →