Skip to content
Threat Feed
Subscribe

Vendor

Immutable.js

1 brief RSS
low advisory

Immutable.js Map/Set Hash Collision Denial of Service Vulnerability

A high-severity algorithmic complexity vulnerability (CVE-2026-59880) in the Immutable.js library's `Immutable.Map` and `Immutable.Set` allows an attacker to craft object keys that cause hash collisions, degrading performance from O(1) to O(N²) and leading to a CPU-bound denial of service in applications, particularly those running on single-threaded Node.js environments that ingest untrusted input as object keys.

Immutable.js +1 denial-of-service algorithmic-complexity immutable-js nodejs vulnerability
2t 1c