{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aimmutable-jsimmutablenode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59880"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Immutable.js (\u003c 4.3.9)","Immutable.js (\u003e= 5.0.0-beta.1, \u003c 5.1.8)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","algorithmic-complexity","immutable-js","nodejs","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Immutable.js"],"content_html":"\u003cp\u003eA high-severity algorithmic complexity vulnerability, identified as CVE-2026-59880, affects all versions of the Immutable.js library through 5.1.7, specifically within its \u003ccode\u003eImmutable.Map\u003c/code\u003e and \u003ccode\u003eImmutable.Set\u003c/code\u003e data structures. Threat actors can exploit this by crafting malicious input where object keys are designed to produce identical 32-bit hash values according to Immutable.js's deterministic string hashing algorithm. When these keys are inserted into or looked up within \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e, the collision resolution mechanism - a linear scan of a collision bucket - causes operations to degrade from an amortized O(1) to O(N) for single operations and O(N²) for building or reading the entire set. This disproportionately consumes CPU resources, leading to a CPU-bound denial of service, particularly impactful for single-threaded JavaScript runtimes like Node.js, which can cause the application's event loop to stall and render the service unavailable. The vulnerability primarily affects applications that ingest untrusted user input (e.g., from request bodies) and use it directly as object keys within Immutable.js structures.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance\u003c/strong\u003e: An attacker identifies a target application utilizing the Immutable.js library and determines that it processes untrusted user input, such as HTTP request bodies, directly into \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e structures.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAlgorithm Analysis\u003c/strong\u003e: The attacker analyzes the Immutable.js deterministic string hashing algorithm (JVM-style polynomial \u003ccode\u003ehashed = (31 * hashed + charCode) | 0\u003c/code\u003e) to understand how hash collisions can be engineered.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Crafting\u003c/strong\u003e: Using the deterministic hashing algorithm, the attacker generates a large set of distinct string keys that all produce the same 32-bit hash value. For example, strings like \u0026quot;Aa\u0026quot; and \u0026quot;BB\u0026quot; hash to the same value (2112), allowing for exponential growth in colliding keys with minimal length.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access / Delivery\u003c/strong\u003e: The attacker sends a crafted payload, typically as a JSON object within an HTTP POST request body, to the vulnerable application endpoint. The crafted strings are used as keys in this JSON object.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcessing\u003c/strong\u003e: The application receives the request and attempts to parse the untrusted input, initializing an \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e (e.g., via \u003ccode\u003eImmutable.Map(req.body)\u003c/code\u003e or \u003ccode\u003eImmutable.fromJS(req.body)\u003c/code\u003e) using the attacker-controlled keys.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eResource Consumption\u003c/strong\u003e: As the application inserts or accesses these colliding keys, the Immutable.js data structures are forced to perform linear scans within their collision buckets. This degrades performance to O(N²) time complexity for processing the entire set of keys.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDenial of Service\u003c/strong\u003e: The excessive CPU consumption caused by the inefficient algorithmic operations leads to a CPU-bound denial of service. In single-threaded runtimes like Node.js, this stalls the event loop, preventing the application from processing legitimate requests and rendering it unresponsive.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59880 results in a severe CPU-bound denial of service for affected applications. This can lead to complete service unavailability, preventing legitimate users from accessing the application's functionalities. The impact is particularly critical for applications built on single-threaded runtimes such as Node.js, where a single malicious request can stall the entire event loop, bringing the application to a halt. While no specific victim counts or industry targets are provided, any application using \u003ccode\u003eImmutable.js\u003c/code\u003e versions prior to \u003ccode\u003e5.1.8\u003c/code\u003e and ingesting untrusted input directly into \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e is susceptible. The vulnerability causes the server to consume disproportionate CPU resources, wasting computational cycles and potentially incurring higher infrastructure costs due to auto-scaling or prolonged unavailability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch Vulnerable Libraries\u003c/strong\u003e: Immediately upgrade the \u003ccode\u003eImmutable.js\u003c/code\u003e library to version \u003ccode\u003e5.1.8\u003c/code\u003e or newer to remediate CVE-2026-59880. This version introduces a per-process seeded secondary hash to handle large collision buckets efficiently.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement Input Validation\u003c/strong\u003e: For applications that cannot be immediately patched, implement strict input validation to cap request body size and limit the number and length of object keys processed from untrusted sources, thereby preventing attacker-controlled payloads from reaching \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAvoid Direct Key Ingestion\u003c/strong\u003e: Review application code to identify instances where untrusted data, especially object keys from sources like \u003ccode\u003ereq.body\u003c/code\u003e, are directly used to construct \u003ccode\u003eImmutable.Map\u003c/code\u003e or \u003ccode\u003eImmutable.Set\u003c/code\u003e and implement sanitization or alternative processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:05:11Z","date_published":"2026-07-21T19:05:11Z","id":"https://feed.craftedsignal.io/briefs/2026-07-immutable-map-hash-collision-dos/","summary":"A high-severity algorithmic complexity vulnerability (CVE-2026-59880) in the Immutable.js library's `Immutable.Map` and `Immutable.Set` allows an attacker to craft object keys that cause hash collisions, degrading performance from O(1) to O(N²) and leading to a CPU-bound denial of service in applications, particularly those running on single-threaded Node.js environments that ingest untrusted input as object keys.","title":"Immutable.js Map/Set Hash Collision Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-immutable-map-hash-collision-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59879"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Immutable.js \u003c 4.3.9","Immutable.js \u003e= 5.0.0-beta.1, \u003c 5.1.8"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","javascript","npm","immutable-js"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity vulnerability (CVE-2026-59879) has been discovered in the \u003ccode\u003eimmutable.js\u003c/code\u003e library, affecting versions \u003ccode\u003e\u0026lt; 4.3.9\u003c/code\u003e and \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt; 5.1.8\u003c/code\u003e. This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) in applications that use \u003ccode\u003eimmutable.js\u003c/code\u003e by supplying specific numeric string inputs to \u003ccode\u003eList#set\u003c/code\u003e, \u003ccode\u003eList#setSize\u003c/code\u003e, \u003ccode\u003eList#setIn\u003c/code\u003e, or \u003ccode\u003eList#updateIn\u003c/code\u003e methods. Specifically, an index in the range \u003ccode\u003e[2 ** 30, 2 ** 31)\u003c/code\u003e can trigger an uncatchable infinite loop on an empty \u003ccode\u003eList\u003c/code\u003e (leading to a tight CPU spin) or unbounded memory allocation on a populated \u003ccode\u003eList\u003c/code\u003e (causing heap exhaustion and process abortion). The vulnerability is rooted in incorrect signed 32-bit bitwise arithmetic handling within \u003ccode\u003esetListBounds()\u003c/code\u003e and can be triggered via a single, small HTTP request body, URL parameter, or key-path, impacting application availability. Additionally, a companion silent data corruption issue in \u003ccode\u003esetSize\u003c/code\u003e can lead to incorrect application state.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts a small HTTP request, embedding a numeric string (e.g., \u003ccode\u003e1073741824\u003c/code\u003e) in the range \u003ccode\u003e[2 ** 30, 2 ** 31)\u003c/code\u003e into a request body, URL, or key-path.\u003c/li\u003e\n\u003cli\u003eThe vulnerable application, using \u003ccode\u003eimmutable.js\u003c/code\u003e versions \u003ccode\u003e\u0026lt; 4.3.9\u003c/code\u003e or \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt; 5.1.8\u003c/code\u003e, receives this request.\u003c/li\u003e\n\u003cli\u003eThe application processes the untrusted input, passing the crafted numeric string as an index to \u003ccode\u003eList#set\u003c/code\u003e, \u003ccode\u003eList#setSize\u003c/code\u003e, \u003ccode\u003eList#setIn\u003c/code\u003e, or \u003ccode\u003eList#updateIn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin \u003ccode\u003eimmutable.js\u003c/code\u003e, the \u003ccode\u003esetListBounds()\u003c/code\u003e function attempts to handle the index using signed 32-bit bitwise arithmetic.\u003c/li\u003e\n\u003cli\u003eDue to a bug where JavaScript's shift count is taken modulo 32, the level-raising loop condition \u003ccode\u003enewTailOffset \u0026gt;= 1 \u0026lt;\u0026lt; (newLevel + SHIFT)\u003c/code\u003e becomes perpetually true.\u003c/li\u003e\n\u003cli\u003eIf the \u003ccode\u003eList\u003c/code\u003e is empty, this results in an uncatchable infinite CPU spin, freezing the worker process.\u003c/li\u003e\n\u003cli\u003eIf the \u003ccode\u003eList\u003c/code\u003e is populated (e.g., from an array with \u0026gt;= 32 elements), each iteration of the loop allocates a new \u003ccode\u003eVNode\u003c/code\u003e without bound, rapidly exhausting the process heap.\u003c/li\u003e\n\u003cli\u003eHeap exhaustion leads to the application process aborting (e.g., \u003ccode\u003eSIGABRT\u003c/code\u003e, exit \u003ccode\u003e134\u003c/code\u003e, or kernel OOM-kill \u003ccode\u003e137\u003c/code\u003e), causing a Denial of Service.\u003c/li\u003e\n\u003cli\u003eAlternatively, if \u003ccode\u003esetSize\u003c/code\u003e is called with a large value like \u003ccode\u003e2 ** 31\u003c/code\u003e or \u003ccode\u003e2 ** 32 + 5\u003c/code\u003e, silent wraparound due to \u003ccode\u003eToInt32\u003c/code\u003e coercion can corrupt the \u003ccode\u003eList\u003c/code\u003e's size to 0 or 5 respectively, leading to data corruption without crashing.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability primarily impacts the availability of applications using vulnerable versions of \u003ccode\u003eimmutable.js\u003c/code\u003e. A single, small, unauthenticated HTTP request can trigger an unrecoverable Denial of Service (DoS) by either causing a worker process to enter an infinite CPU spin, effectively hanging, or by forcing the process to consume all available memory, leading to an application crash (e.g., \u003ccode\u003eSIGABRT\u003c/code\u003e or OOM-kill). This can affect common application patterns such as configuration stores, document/collection editors, Redux-Immutable reducers, or JSON-Patch endpoints that route untrusted input into \u003ccode\u003eList\u003c/code\u003e operations. There is no observed impact on confidentiality or integrity, nor does it lead to Remote Code Execution (RCE). The companion silent data corruption issue can lead to applications operating with incorrect state, potentially causing further malfunctions, but without an immediate crash.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eUpgrade immutable.js:\u003c/strong\u003e Immediately upgrade \u003ccode\u003eimmutable.js\u003c/code\u003e to version \u003ccode\u003e4.3.9\u003c/code\u003e or higher, or to \u003ccode\u003e5.1.8\u003c/code\u003e or higher for the v5 beta releases, to remediate CVE-2026-59879.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement Input Validation:\u003c/strong\u003e For systems that cannot be immediately upgraded, validate and clamp any externally supplied \u003ccode\u003eList\u003c/code\u003e index or \u003ccode\u003esetIn\u003c/code\u003e/\u003ccode\u003eupdateIn\u003c/code\u003e key-path segments. Reject numeric path segments greater than or equal to \u003ccode\u003e2 ** 30\u003c/code\u003e before passing them to \u003ccode\u003eimmutable.js\u003c/code\u003e methods.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eContainerize and Resource Limit Applications:\u003c/strong\u003e Run request handling processes in isolated worker environments with resource limits (e.g., cap heap size using \u003ccode\u003e--max-old-space-size\u003c/code\u003e) to contain any potential process aborts, allowing for faster recovery or restart of affected workers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T18:39:19Z","date_published":"2026-07-21T18:39:19Z","id":"https://feed.craftedsignal.io/briefs/2026-07-immutable-js-dos/","summary":"A vulnerability in Immutable.js List methods (`#set`, `#setSize`, `#setIn`, `#updateIn`) allows a remote, unauthenticated attacker to trigger an infinite loop or heap exhaustion by providing a crafted numeric string index in the range `[2 ** 30, 2 ** 31)`. This leads to an unrecoverable Denial of Service (DoS) by causing a tight CPU spin or process abortion, with an additional silent data corruption issue in `setSize`. This vulnerability impacts application availability but not confidentiality or integrity, and can be triggered by a single small HTTP request.","title":"Immutable.js List 32-bit Trie Overflow Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-immutable-js-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:immutable-Js:immutable:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}