CVE-2026-59880
HIGHImmutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-59880. PoCs published by nvth.
AI-analyzed exploit summary The repository contains only a README.md and LICENSE file with no exploit code, technical details, or functional PoC. It references an external write-up but does not include any substantive content itself.
Description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
Exploits (1)
The repository contains only a README.md and LICENSE file with no exploit code, technical details, or functional PoC. It references an external write-up but does not include any substantive content itself.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H