← back
CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

CVSS 8.7 HIGHEPSS 0.6%CWE-1321
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
immutable-js · immutable-js

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw