← Vulnerability feed

Vulnerability record · CVE-2026-29063 · published 6 March 2026

CVE-2026-29063: Immutable-js immutable prototype pollution vulnerability

Immutable Js · Immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

8.7 CVSS 4.0 High EPSS 0.99% · top 37.0% CWE-1321 · Prototype pollutionCWE-915 · Mass assignment
8.7CVSS 4.0 base score
0.99%EPSS exploitation probability, 30 days
NoNot in CISA KEV
27Affected product versions listed by NVD
72References, 1 tagged exploit
30 Oct 2026Last modified by NVD

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

27 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 Release Notes
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 Release Notes
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 Release Notes
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw ExploitVendor Advisory
https://access.redhat.com/errata/RHSA-2026:11070 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11217 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11414 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11858 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11916 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:12118 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13542 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13548 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13791 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13826 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13829 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13847 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13853 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:17469 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:17598 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19375 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19409 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19410 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19712 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20034 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20041 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20042 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20088 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21657 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21658 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21703 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21931 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:22465 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:23246 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24473 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24977 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26225 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:26232 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:27063 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:28893 Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:28964 Vendor Advisory

Track CVE-2026-29063 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed6.5CVE-2026-48710Starlette Host header validation flaw enables request.url path mismatchStarlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url…KEVEPSS 70%analysed9.8CVE-2017-7512Redhat 3scale api management platform incorrect authorization vulnerabilityRed Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attack…EPSS 2.2%8.8CVE-2022-1902Redhat advanced cluster security exposure of resource to wrong sphere vulnerabilityA flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw …EPSS 1.4%8.8CVE-2021-4112Redhat ansible automation platform early access vulnerabilityA flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevate the p…EPSS 0.25%8.7CVE-2026-59879Immutable-js immutable integer overflow vulnerabilityImmutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the…EPSS 0.58%8.7CVE-2026-59880Immutable-js immutable vulnerabilityImmutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the s…EPSS 0.66%8.2CVE-2026-4740Redhat advanced cluster management for kubernetes improper certificate validation vulnerabilityA flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubern…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2026-29063), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.