Skip to main content
cve.nowby Sazabi
← npm
npmPackage

immutable

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
5.1.9 (Jun 29, 2026): no advisory affects it
Newest unaffected release
5.1.9 (Jun 29, 2026), the latest release
Advisories
3 · 3 high
Weekly downloads
58.1M
Dependents
23.1K
Releases
123 since 0.8.0 (Mar 27, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59879
    Affects 0.8.0-SNAPSHOT to 3.8.3 (3.8.4 is outside it); 4.0.0-rc.1 to 4.3.8 (4.3.9 is outside it); 5.0.0-beta.1 to 5.1.7 (5.1.8 is outside it)
  • CVE-2026-59880
    Affects 0.8.0-SNAPSHOT to 3.8.3 (3.8.4 is outside it); 4.0.0-rc.1 to 4.3.8 (4.3.9 is outside it); 5.0.0-beta.1 to 5.1.7 (5.1.8 is outside it)
  • CVE-2026-29063
    Affects 0.8.0-SNAPSHOT to 3.8.2 (3.8.3 is outside it); 4.0.0-rc.1 to 4.3.7 (4.3.8 is outside it); 5.0.0 to 5.1.4 (5.1.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

    Affected: from 4.0.0-rc.1, fixed in 4.3.9; from 5.0.0-beta.1, fixed in 5.1.8; fixed in 3.8.4.

    Fixed in 3.8.4 (released Aug 14, 2026, 37 days after disclosure), 4.3.9 (released Jun 25, 2026, 13 days before disclosure) and 5.1.8 (released Jun 25, 2026, 13 days before disclosure).

    The latest release, 5.1.9, is not affected.

    51% of immutable downloads last week were affected versions (34.7M).

  • Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

    Affected: from 4.0.0-beta.1, fixed in 4.3.9; from 5.0.0-beta.1, fixed in 5.1.8; fixed in 3.8.4.

    Fixed in 3.8.4 (released Aug 14, 2026, 37 days after disclosure), 4.3.9 (released Jun 25, 2026, 13 days before disclosure) and 5.1.8 (released Jun 25, 2026, 13 days before disclosure).

    The latest release, 5.1.9, is not affected.

    51% of immutable downloads last week were affected versions (34.7M).

  • Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

    Affected: from 4.0.0-rc.1, fixed in 4.3.8; from 5.0.0, fixed in 5.1.5; fixed in 3.8.3.

    Fixed in 3.8.3 (released Mar 6, 2026, the day of disclosure), 4.3.8 (released Mar 3, 2026, 3 days before disclosure) and 5.1.5 (released Mar 3, 2026, 3 days before disclosure).

    The latest release, 5.1.9, is not affected.

    39% of immutable downloads last week were affected versions (26M).