{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/immutable.js--5.0.0-beta.1--5.1.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59879"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Immutable.js \u003c 4.3.9","Immutable.js \u003e= 5.0.0-beta.1, \u003c 5.1.8"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","javascript","npm","immutable-js"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity vulnerability (CVE-2026-59879) has been discovered in the \u003ccode\u003eimmutable.js\u003c/code\u003e library, affecting versions \u003ccode\u003e\u0026lt; 4.3.9\u003c/code\u003e and \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt; 5.1.8\u003c/code\u003e. This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) in applications that use \u003ccode\u003eimmutable.js\u003c/code\u003e by supplying specific numeric string inputs to \u003ccode\u003eList#set\u003c/code\u003e, \u003ccode\u003eList#setSize\u003c/code\u003e, \u003ccode\u003eList#setIn\u003c/code\u003e, or \u003ccode\u003eList#updateIn\u003c/code\u003e methods. Specifically, an index in the range \u003ccode\u003e[2 ** 30, 2 ** 31)\u003c/code\u003e can trigger an uncatchable infinite loop on an empty \u003ccode\u003eList\u003c/code\u003e (leading to a tight CPU spin) or unbounded memory allocation on a populated \u003ccode\u003eList\u003c/code\u003e (causing heap exhaustion and process abortion). The vulnerability is rooted in incorrect signed 32-bit bitwise arithmetic handling within \u003ccode\u003esetListBounds()\u003c/code\u003e and can be triggered via a single, small HTTP request body, URL parameter, or key-path, impacting application availability. Additionally, a companion silent data corruption issue in \u003ccode\u003esetSize\u003c/code\u003e can lead to incorrect application state.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker crafts a small HTTP request, embedding a numeric string (e.g., \u003ccode\u003e1073741824\u003c/code\u003e) in the range \u003ccode\u003e[2 ** 30, 2 ** 31)\u003c/code\u003e into a request body, URL, or key-path.\u003c/li\u003e\n\u003cli\u003eThe vulnerable application, using \u003ccode\u003eimmutable.js\u003c/code\u003e versions \u003ccode\u003e\u0026lt; 4.3.9\u003c/code\u003e or \u003ccode\u003e\u0026gt;= 5.0.0-beta.1, \u0026lt; 5.1.8\u003c/code\u003e, receives this request.\u003c/li\u003e\n\u003cli\u003eThe application processes the untrusted input, passing the crafted numeric string as an index to \u003ccode\u003eList#set\u003c/code\u003e, \u003ccode\u003eList#setSize\u003c/code\u003e, \u003ccode\u003eList#setIn\u003c/code\u003e, or \u003ccode\u003eList#updateIn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eWithin \u003ccode\u003eimmutable.js\u003c/code\u003e, the \u003ccode\u003esetListBounds()\u003c/code\u003e function attempts to handle the index using signed 32-bit bitwise arithmetic.\u003c/li\u003e\n\u003cli\u003eDue to a bug where JavaScript's shift count is taken modulo 32, the level-raising loop condition \u003ccode\u003enewTailOffset \u0026gt;= 1 \u0026lt;\u0026lt; (newLevel + SHIFT)\u003c/code\u003e becomes perpetually true.\u003c/li\u003e\n\u003cli\u003eIf the \u003ccode\u003eList\u003c/code\u003e is empty, this results in an uncatchable infinite CPU spin, freezing the worker process.\u003c/li\u003e\n\u003cli\u003eIf the \u003ccode\u003eList\u003c/code\u003e is populated (e.g., from an array with \u0026gt;= 32 elements), each iteration of the loop allocates a new \u003ccode\u003eVNode\u003c/code\u003e without bound, rapidly exhausting the process heap.\u003c/li\u003e\n\u003cli\u003eHeap exhaustion leads to the application process aborting (e.g., \u003ccode\u003eSIGABRT\u003c/code\u003e, exit \u003ccode\u003e134\u003c/code\u003e, or kernel OOM-kill \u003ccode\u003e137\u003c/code\u003e), causing a Denial of Service.\u003c/li\u003e\n\u003cli\u003eAlternatively, if \u003ccode\u003esetSize\u003c/code\u003e is called with a large value like \u003ccode\u003e2 ** 31\u003c/code\u003e or \u003ccode\u003e2 ** 32 + 5\u003c/code\u003e, silent wraparound due to \u003ccode\u003eToInt32\u003c/code\u003e coercion can corrupt the \u003ccode\u003eList\u003c/code\u003e's size to 0 or 5 respectively, leading to data corruption without crashing.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability primarily impacts the availability of applications using vulnerable versions of \u003ccode\u003eimmutable.js\u003c/code\u003e. A single, small, unauthenticated HTTP request can trigger an unrecoverable Denial of Service (DoS) by either causing a worker process to enter an infinite CPU spin, effectively hanging, or by forcing the process to consume all available memory, leading to an application crash (e.g., \u003ccode\u003eSIGABRT\u003c/code\u003e or OOM-kill). This can affect common application patterns such as configuration stores, document/collection editors, Redux-Immutable reducers, or JSON-Patch endpoints that route untrusted input into \u003ccode\u003eList\u003c/code\u003e operations. There is no observed impact on confidentiality or integrity, nor does it lead to Remote Code Execution (RCE). The companion silent data corruption issue can lead to applications operating with incorrect state, potentially causing further malfunctions, but without an immediate crash.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eUpgrade immutable.js:\u003c/strong\u003e Immediately upgrade \u003ccode\u003eimmutable.js\u003c/code\u003e to version \u003ccode\u003e4.3.9\u003c/code\u003e or higher, or to \u003ccode\u003e5.1.8\u003c/code\u003e or higher for the v5 beta releases, to remediate CVE-2026-59879.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement Input Validation:\u003c/strong\u003e For systems that cannot be immediately upgraded, validate and clamp any externally supplied \u003ccode\u003eList\u003c/code\u003e index or \u003ccode\u003esetIn\u003c/code\u003e/\u003ccode\u003eupdateIn\u003c/code\u003e key-path segments. Reject numeric path segments greater than or equal to \u003ccode\u003e2 ** 30\u003c/code\u003e before passing them to \u003ccode\u003eimmutable.js\u003c/code\u003e methods.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eContainerize and Resource Limit Applications:\u003c/strong\u003e Run request handling processes in isolated worker environments with resource limits (e.g., cap heap size using \u003ccode\u003e--max-old-space-size\u003c/code\u003e) to contain any potential process aborts, allowing for faster recovery or restart of affected workers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T18:39:19Z","date_published":"2026-07-21T18:39:19Z","id":"https://feed.craftedsignal.io/briefs/2026-07-immutable-js-dos/","summary":"A vulnerability in Immutable.js List methods (`#set`, `#setSize`, `#setIn`, `#updateIn`) allows a remote, unauthenticated attacker to trigger an infinite loop or heap exhaustion by providing a crafted numeric string index in the range `[2 ** 30, 2 ** 31)`. This leads to an unrecoverable Denial of Service (DoS) by causing a tight CPU spin or process abortion, with an additional silent data corruption issue in `setSize`. This vulnerability impacts application availability but not confidentiality or integrity, and can be triggered by a single small HTTP request.","title":"Immutable.js List 32-bit Trie Overflow Leads to Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-07-immutable-js-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Immutable.js \u003e= 5.0.0-Beta.1, \u003c 5.1.8","version":"https://jsonfeed.org/version/1.1"}