CVE-2026-29063

HIGH8.7

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Published Mar 6, 2026

Modified 4 weeks ago

Details

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

References

WEB

https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3

WEB

https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8

WEB

https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5

WEB

https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-29063

CVSS Analysis