CVE-2026-59880highCWE-407

CVE-2026-59880: high-severity vulnerability in immutable-js

Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Published

Follow this CVE+ Monitor immutable-js+ Monitor node-immutable

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.7%
from disclosure to weapon15 days
Published on NVDJul 8
1st PoC+15d
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
immutable-js · immutable-js
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — immutable-js

In the same product, most dangerous first.

CVE-2026-29063HIGHImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableEPSS 1.0%CVE-2026-59879HIGHImmutable.js `List` 32-bit trie overflow → unrecoverable DoSEPSS 0.6%