CVE-2026-29063

CRITICAL

Immutable.js <3.8.3/4.3.7/5.1.5 - Prototype Pollution

Title source: llm
STIX 2.1

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

References (72)

Core 72
Core References

Scores

CVSS v3 9.8
EPSS 0.0098
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1321 CWE-915
Status published
Products (5)
immutable-js/immutable 3.0.0 - 3.8.3
immutable-js/immutable-js < 3.8.3
immutable-js/immutable-js < 4.3.7
immutable-js/immutable-js < 5.1.5
npm/immutable 4.0.0-rc.1 - 4.3.8npm
Published Mar 06, 2026
Tracked Since Mar 07, 2026