CVE-2026-29063
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
| CWE | CWE-1321 |
| Vendor | immutable-js |
| Product | immutable-js |
| Published | Mar 6, 2026 |
| Last Updated | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for immutable-js immutable-js
Be the first to know when new high vulnerabilities affecting immutable-js immutable-js are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
immutable-js / immutable-js
< 3.8.3 < 4.3.7 < 5.1.5
References
github.com: https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw github.com: https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 github.com: https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 github.com: https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-29063 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2445291 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19409 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19410 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6428 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24473 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13548 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13847 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11070 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11217 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13791 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13829 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9742 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13826 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7329 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40945 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24977 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19712 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34049 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40022 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28893 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28964 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36621 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20088 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34100 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34099 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17598 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21658 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29857 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21657 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:12118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20042 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29864 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:23246 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20041 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17469 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27063 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21703 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20034 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21931 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8483 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8484 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8490 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8491 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8493 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41941 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41944 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40984 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6720 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6568 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19375 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:22465 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11916 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6926 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26232 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26225 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13853 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13542 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9848 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11858 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8218 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11414