Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:immutable-Js:immutable:*:*:*:*:*:node.js:*:*

2 briefs RSS
low advisory

Immutable.js Map/Set Hash Collision Denial of Service Vulnerability

A high-severity algorithmic complexity vulnerability (CVE-2026-59880) in the Immutable.js library's `Immutable.Map` and `Immutable.Set` allows an attacker to craft object keys that cause hash collisions, degrading performance from O(1) to O(N²) and leading to a CPU-bound denial of service in applications, particularly those running on single-threaded Node.js environments that ingest untrusted input as object keys.

Immutable.js +1 denial-of-service algorithmic-complexity immutable-js nodejs vulnerability
2t 1c
low advisory

Immutable.js List 32-bit Trie Overflow Leads to Denial of Service

A vulnerability in Immutable.js List methods (`#set`, `#setSize`, `#setIn`, `#updateIn`) allows a remote, unauthenticated attacker to trigger an infinite loop or heap exhaustion by providing a crafted numeric string index in the range `[2 ** 30, 2 ** 31)`. This leads to an unrecoverable Denial of Service (DoS) by causing a tight CPU spin or process abortion, with an additional silent data corruption issue in `setSize`. This vulnerability impacts application availability but not confidentiality or integrity, and can be triggered by a single small HTTP request.

Immutable.js < 4.3.9 +1 denial-of-service vulnerability javascript npm immutable-js
1t 1c 2i