Immutable-Js - CraftedSignal Threat Feed

Immutable.js Map/Set Hash Collision Denial of Service Vulnerability

hello@craftedsignal.io — Tue, 21 Jul 2026 19:05:11 +0000

A high-severity algorithmic complexity vulnerability, identified as CVE-2026-59880, affects all versions of the Immutable.js library through 5.1.7, specifically within its Immutable.Map and Immutable.Set data structures. Threat actors can exploit this by crafting malicious input where object keys are designed to produce identical 32-bit hash values according to Immutable.js's deterministic string hashing algorithm. When these keys are inserted into or looked up within Immutable.Map or Immutable.Set, the collision resolution mechanism - a linear scan of a collision bucket - causes operations to degrade from an amortized O(1) to O(N) for single operations and O(N²) for building or reading the entire set. This disproportionately consumes CPU resources, leading to a CPU-bound denial of service, particularly impactful for single-threaded JavaScript runtimes like Node.js, which can cause the application's event loop to stall and render the service unavailable. The vulnerability primarily affects applications that ingest untrusted user input (e.g., from request bodies) and use it directly as object keys within Immutable.js structures.

Attack Chain

Reconnaissance: An attacker identifies a target application utilizing the Immutable.js library and determines that it processes untrusted user input, such as HTTP request bodies, directly into Immutable.Map or Immutable.Set structures.
Algorithm Analysis: The attacker analyzes the Immutable.js deterministic string hashing algorithm (JVM-style polynomial hashed = (31 * hashed + charCode) | 0) to understand how hash collisions can be engineered.
Payload Crafting: Using the deterministic hashing algorithm, the attacker generates a large set of distinct string keys that all produce the same 32-bit hash value. For example, strings like "Aa" and "BB" hash to the same value (2112), allowing for exponential growth in colliding keys with minimal length.
Initial Access / Delivery: The attacker sends a crafted payload, typically as a JSON object within an HTTP POST request body, to the vulnerable application endpoint. The crafted strings are used as keys in this JSON object.
Processing: The application receives the request and attempts to parse the untrusted input, initializing an Immutable.Map or Immutable.Set (e.g., via Immutable.Map(req.body) or Immutable.fromJS(req.body)) using the attacker-controlled keys.
Resource Consumption: As the application inserts or accesses these colliding keys, the Immutable.js data structures are forced to perform linear scans within their collision buckets. This degrades performance to O(N²) time complexity for processing the entire set of keys.
Denial of Service: The excessive CPU consumption caused by the inefficient algorithmic operations leads to a CPU-bound denial of service. In single-threaded runtimes like Node.js, this stalls the event loop, preventing the application from processing legitimate requests and rendering it unresponsive.

Impact

Successful exploitation of CVE-2026-59880 results in a severe CPU-bound denial of service for affected applications. This can lead to complete service unavailability, preventing legitimate users from accessing the application's functionalities. The impact is particularly critical for applications built on single-threaded runtimes such as Node.js, where a single malicious request can stall the entire event loop, bringing the application to a halt. While no specific victim counts or industry targets are provided, any application using Immutable.js versions prior to 5.1.8 and ingesting untrusted input directly into Immutable.Map or Immutable.Set is susceptible. The vulnerability causes the server to consume disproportionate CPU resources, wasting computational cycles and potentially incurring higher infrastructure costs due to auto-scaling or prolonged unavailability.

Recommendation

Patch Vulnerable Libraries: Immediately upgrade the Immutable.js library to version 5.1.8 or newer to remediate CVE-2026-59880. This version introduces a per-process seeded secondary hash to handle large collision buckets efficiently.
Implement Input Validation: For applications that cannot be immediately patched, implement strict input validation to cap request body size and limit the number and length of object keys processed from untrusted sources, thereby preventing attacker-controlled payloads from reaching Immutable.Map or Immutable.Set.
Avoid Direct Key Ingestion: Review application code to identify instances where untrusted data, especially object keys from sources like req.body, are directly used to construct Immutable.Map or Immutable.Set and implement sanitization or alternative processing.

Immutable.js List 32-bit Trie Overflow Leads to Denial of Service

hello@craftedsignal.io — Tue, 21 Jul 2026 18:39:19 +0000

A high-severity vulnerability (CVE-2026-59879) has been discovered in the immutable.js library, affecting versions < 4.3.9 and >= 5.0.0-beta.1, < 5.1.8. This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) in applications that use immutable.js by supplying specific numeric string inputs to List#set, List#setSize, List#setIn, or List#updateIn methods. Specifically, an index in the range [2 ** 30, 2 ** 31) can trigger an uncatchable infinite loop on an empty List (leading to a tight CPU spin) or unbounded memory allocation on a populated List (causing heap exhaustion and process abortion). The vulnerability is rooted in incorrect signed 32-bit bitwise arithmetic handling within setListBounds() and can be triggered via a single, small HTTP request body, URL parameter, or key-path, impacting application availability. Additionally, a companion silent data corruption issue in setSize can lead to incorrect application state.

Attack Chain

An unauthenticated attacker crafts a small HTTP request, embedding a numeric string (e.g., 1073741824) in the range [2 ** 30, 2 ** 31) into a request body, URL, or key-path.
The vulnerable application, using immutable.js versions < 4.3.9 or >= 5.0.0-beta.1, < 5.1.8, receives this request.
The application processes the untrusted input, passing the crafted numeric string as an index to List#set, List#setSize, List#setIn, or List#updateIn.
Within immutable.js, the setListBounds() function attempts to handle the index using signed 32-bit bitwise arithmetic.
Due to a bug where JavaScript's shift count is taken modulo 32, the level-raising loop condition newTailOffset >= 1 << (newLevel + SHIFT) becomes perpetually true.
If the List is empty, this results in an uncatchable infinite CPU spin, freezing the worker process.
If the List is populated (e.g., from an array with >= 32 elements), each iteration of the loop allocates a new VNode without bound, rapidly exhausting the process heap.
Heap exhaustion leads to the application process aborting (e.g., SIGABRT, exit 134, or kernel OOM-kill 137), causing a Denial of Service.
Alternatively, if setSize is called with a large value like 2 ** 31 or 2 ** 32 + 5, silent wraparound due to ToInt32 coercion can corrupt the List's size to 0 or 5 respectively, leading to data corruption without crashing.

Impact

This vulnerability primarily impacts the availability of applications using vulnerable versions of immutable.js. A single, small, unauthenticated HTTP request can trigger an unrecoverable Denial of Service (DoS) by either causing a worker process to enter an infinite CPU spin, effectively hanging, or by forcing the process to consume all available memory, leading to an application crash (e.g., SIGABRT or OOM-kill). This can affect common application patterns such as configuration stores, document/collection editors, Redux-Immutable reducers, or JSON-Patch endpoints that route untrusted input into List operations. There is no observed impact on confidentiality or integrity, nor does it lead to Remote Code Execution (RCE). The companion silent data corruption issue can lead to applications operating with incorrect state, potentially causing further malfunctions, but without an immediate crash.

Recommendation

Upgrade immutable.js: Immediately upgrade immutable.js to version 4.3.9 or higher, or to 5.1.8 or higher for the v5 beta releases, to remediate CVE-2026-59879.
Implement Input Validation: For systems that cannot be immediately upgraded, validate and clamp any externally supplied List index or setIn/updateIn key-path segments. Reject numeric path segments greater than or equal to 2 ** 30 before passing them to immutable.js methods.
Containerize and Resource Limit Applications: Run request handling processes in isolated worker environments with resource limits (e.g., cap heap size using --max-old-space-size) to contain any potential process aborts, allowing for faster recovery or restart of affected workers.