VULNERABILITY INTELLIGENCE
CVE-2026-29063
CVSS score9.8 CRITICAL
EPSS probability0.99%
CISA KEVNot currently listed
Published2026-03-06
Last modified2026-10-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Weakness classification
- security-advisories@github.com: CWE-1321
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-915
Primary references
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Exploit, Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c — Vendor Advisory