Denial of Service in Immutable.js Affecting Data Structures
CVE-2026-59880
8.7HIGH
What is CVE-2026-59880?
Immutable.js exhibits a vulnerability in its data structures, specifically in Immutable.Map and Immutable.Set. Prior to versions 4.3.9 and 5.1.8, these structures use a linear search method in a HashCollisionNode bucket containing keys with the same 32-bit hash. An attacker controlling the input keys can create numerous colliding keys, which results in excessive CPU resource usage during insertion and lookup processes. This issue could lead to significant performance degradation, potentially affecting the application's availability.
Affected Version(s)
immutable-js < 4.3.9 < 4.3.9
immutable-js >= 5.0.0-beta.1, < 5.1.8 < 5.0.0-beta.1, 5.1.8