CVE-2026-29063
1 advisory.
npm/immutable CVE-2026-29063: critical 9.8, EPSS 1.64%
Immutable is vulnerable to Prototype Pollution
Action: Upgrade immutable to 3.8.3 or later.
npm i immutable@4.3.8npm i immutable@5.1.5npm i immutable@3.8.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-rc.1 | 4.3.8 | - |
| 5.0.0 | 5.1.5 | - |
| 0 | 3.8.3 | - |
Fixed versions
| 4.3.8 | 5.1.5 | 3.8.3 |
Sources
- osv: GHSA-wf6x-7x77-mvgw
- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw
- https://nvd.nist.gov/vuln/detail/CVE-2026-29063
- https://github.com/immutable-js/immutable-js/issues/2178
- https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945
- https://github.com/immutable-js/immutable-js/commit/6e2cf1cfe6137e72dfa48fc2cfa8f4d399d113f9
- https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb
- https://github.com/immutable-js/immutable-js
- https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3
- https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8
- https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5
CVE-2026-29063 · published · modified · JSON