{"id":"CVE-2026-59880","aliases":["CLSA-2026-1784769617","CLSA-2026-1784856200","CLSA-2026-1784856463","CLSA-2026-1784943220","CLSA-2026-1784943293","CLSA-2026-1784943404","CLSA-2026-1785117466","CLSA-2026-1790084679","CLSA-2026-1790808099","CLSA-2026-1792163804","DEBIAN-CVE-2026-59880","EUVD-2026-42315","GHSA-xvcm-6775-5m9r","ROOT-APP-NPM-CVE-2026-59880","UBUNTU-CVE-2026-59880"],"status":"published","title":"Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00665,"percentile":0.52131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-407"],"published":"2026-07-08T15:44:23Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"immutable","fixed_in":["5.1.8","4.3.9","3.8.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"immutable","fixed_in":["5.0.3-tuxcare.3","4.3.7-tuxcare.3","4.3.5-tuxcare.3","4.1.0-tuxcare.3","3.8.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-immutable","fixed_in":["4.3.9-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"immutable","fixed_in":["3.8.4-aikido.2","5.0.3-aikido.1","4.3.8-aikido.1","5.1.5-aikido.1","5.1.7-aikido.1","5.1.1-aikido.5","4.3.8-aikido.2","3.7.6-aikido.3","4.3.7-aikido.4","5.1.6-aikido.2","3.8.3-aikido.2","5.0.3-aikido.2","4.0.0-aikido.1","4.0.0-aikido.2","3.8.4-aikido.1","4.3.6-aikido.1","4.0.0-rc.12-aikido.1","3.7.6-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/immutable","fixed_in":["3.8.4-root.io.2","5.0.3-root.io.1","4.3.8-root.io.1","5.1.5-root.io.1","5.1.7-root.io.1","5.1.1-root.io.5","4.3.8-root.io.2","3.7.6-root.io.3","4.3.7-root.io.4","5.1.6-root.io.2","3.8.3-root.io.2","5.0.3-root.io.2","4.0.0-root.io.1","4.0.0-root.io.2","3.8.4-root.io.1","4.3.6-root.io.1","4.0.0-rc.12-root.io.1","3.7.6-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-beta.1"},{"fixed":"5.1.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-beta.1"},{"fixed":"4.3.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.3"}]}],"versions":["5.0.3","5.0.3-tuxcare.1","5.0.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.7-tuxcare.0"},{"fixed":"4.3.7-tuxcare.3"}]}],"versions":["4.3.7","4.3.7-tuxcare.1","4.3.7-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.5-tuxcare.0"},{"fixed":"4.3.5-tuxcare.3"}]}],"versions":["4.3.5","4.3.5-tuxcare.1","4.3.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-tuxcare.0"},{"fixed":"4.1.0-tuxcare.3"}]}],"versions":["4.1.0","4.1.0-tuxcare.1","4.1.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.3-tuxcare.0"},{"fixed":"3.8.3-tuxcare.1"}]}],"versions":["3.8.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.2"}]}],"versions":["3.8.2","3.8.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.1-tuxcare.0"},{"fixed":"3.8.1-tuxcare.2"}]}],"versions":["3.8.1","3.8.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5-tuxcare.0"},{"fixed":"5.1.5-tuxcare.1"}]}],"versions":["5.1.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.7.6-tuxcare.0"},{"fixed":"3.7.6-tuxcare.1"}]}],"versions":["3.7.6"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.8-tuxcare.0"},{"fixed":"4.3.8-tuxcare.1"}]}],"versions":["4.3.8"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-3","4.3.4-1","4.3.8-1","4.3.8-2","4.3.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1","4.3.8-1","4.3.8-2","4.3.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-1"}]}],"versions":["4.3.4-1","4.3.8-1","4.3.8-2"]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-beta.1"},{"fixed":"4.3.9"}]}]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0-beta.1"},{"fixed":"5.1.8"}]}]},{"source":"osv","ecosystem":"npm","package":"immutable","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-aikido.2"},{"fixed":"5.0.3-aikido.1"},{"fixed":"4.3.8-aikido.1"},{"fixed":"5.1.5-aikido.1"},{"fixed":"5.1.7-aikido.1"},{"fixed":"5.1.1-aikido.5"},{"fixed":"4.3.8-aikido.2"},{"fixed":"3.7.6-aikido.3"},{"fixed":"4.3.7-aikido.4"},{"fixed":"5.1.6-aikido.2"},{"fixed":"3.8.3-aikido.2"},{"fixed":"5.0.3-aikido.2"},{"fixed":"4.0.0-aikido.1"},{"fixed":"4.0.0-aikido.2"},{"fixed":"3.8.4-aikido.1"},{"fixed":"4.3.6-aikido.1"},{"fixed":"4.0.0-rc.12-aikido.1"},{"fixed":"3.7.6-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.4-root.io.2"},{"fixed":"5.0.3-root.io.1"},{"fixed":"4.3.8-root.io.1"},{"fixed":"5.1.5-root.io.1"},{"fixed":"5.1.7-root.io.1"},{"fixed":"5.1.1-root.io.5"},{"fixed":"4.3.8-root.io.2"},{"fixed":"3.7.6-root.io.3"},{"fixed":"4.3.7-root.io.4"},{"fixed":"5.1.6-root.io.2"},{"fixed":"3.8.3-root.io.2"},{"fixed":"5.0.3-root.io.2"},{"fixed":"4.0.0-root.io.1"},{"fixed":"4.0.0-root.io.2"},{"fixed":"3.8.4-root.io.1"},{"fixed":"4.3.6-root.io.1"},{"fixed":"4.0.0-rc.12-root.io.1"},{"fixed":"3.7.6-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.2+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.2+dfsg-3","4.0.0-1","4.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-3","4.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.8-2","4.3.9-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-immutable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.4-1","4.3.8-2"]}],"products":[{"vendor":"immutable-js","product":"immutable"},{"vendor":"immutable-js","product":"immutable-js"}],"references":[{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59880","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xvcm-6775-5m9r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59880.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59880","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-59880","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59880","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-59880","title":"Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T15:44:23.414Z","modified":"2026-07-08T16:13:46.106Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-42315","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T15:44:23Z","modified":"2026-07-08T16:13:46Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:20:10.578977Z"}],"ghsa":[{"id":"GHSA-xvcm-6775-5m9r","title":"Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set","description":"## Summary\n\n`Immutable.Map` and `Immutable.Set` keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the **keys** inserted into a Map can craft many keys that all collide, degrading insertion and lookup from amortized O(1) to O(n) per operation — and O(n²) to build or read the whole set. A small, attacker-shaped payload can therefore consume disproportionate CPU and, on a single-threaded runtime such as Node.js, stall the event loop and deny service.\n\n## Details\n\nThe string hash uses the JVM-style polynomial `hashed = (31 * hashed + charCode) | 0`. Strings such as `\"Aa\"` and `\"BB\"` hash to the same value (`65*31+97 == 66*31+66 == 2112`), and concatenating such blocks yields `2^n` distinct strings sharing one hash (40 characters ⇒ \u003e1,000,000 colliding keys). \nAll such keys route to a single `HashCollisionNode`, whose `get`/`update` walk the entire bucket testing `is()`. There is no per-process salt, so the colliding set is fully precomputable from the open-source algorithm.\n\n## Proof of concept\n\nInserting N colliding keys (e.g. via `Immutable.Map(obj)` / `Immutable.fromJS(obj)`) is O(N²). Measured on one machine, ~8,000 colliding\nkeys take ~0.7 s to build and ~0.6 s to read, scaling ×4 per doubling; ~16,000 keys exceed several seconds.\n\n## Impact\n\nCPU-bound denial of service in applications that ingest attacker-controlled object **keys** into Immutable structures, e.g. `Immutable.Map(req.body)`, `Immutable.fromJS(req.body)`, `state.merge(userObject)` / `mergeDeep(...)`. Applications that only store attacker input as **values** under fixed keys are not affected.\n\n## Affected versions\n\n- \u003e= 4.0.0-beta.1, \u003c 4.3.9\n- \u003e= 5.0.0-beta.1, \u003c 5.1.8\n- \u003c 3.8.4\n\n## Patches\n\nFixed in `5.1.8` _(adjust to the actual release)_: large collision buckets are indexed by a per-process **seeded** secondary hash, restoring near-linear behavior for the affected paths. The public `hash()` is unchanged (no breaking change), and `is()` remains the sole authority on key equality. Also fixed in 4.3.9 and 3.8.4.\n\n## Workarounds\n\nBefore passing untrusted data to Immutable.js: cap request body size, limit object key count/length, and reject high-cardinality payloads; avoid building Maps directly from untrusted object keys.\n\n## References\n\n- CWE-407 (Inefficient Algorithmic Complexity), CWE-400 (Uncontrolled Resource Consumption)\n- OWASP API4:2023 (Unrestricted Resource Consumption)","status":"published","published":"2026-07-21T19:02:33Z","modified":"2026-09-03T16:38:03Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-59880","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T16:16:34.517Z","modified":"2026-07-10T18:49:51.197Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"CVE-2026-59880","title":"Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T15:44:23.414Z","modified":"2026-10-28T02:30:39.065758942Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59880","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T16:16:34.517Z","modified":"2026-10-01T03:03:28.518623247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-xvcm-6775-5m9r","title":"Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set","description":"## Summary\n\n`Immutable.Map` and `Immutable.Set` keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the **keys** inserted into a Map can craft many keys that all collide, degrading insertion and lookup from amortized O(1) to O(n) per operation — and O(n²) to build or read the whole set. A small, attacker-shaped payload can therefore consume disproportionate CPU and, on a single-threaded runtime such as Node.js, stall the event loop and deny service.\n\n## Details\n\nThe string hash uses the JVM-style polynomial `hashed = (31 * hashed + charCode) | 0`. Strings such as `\"Aa\"` and `\"BB\"` hash to the same value (`65*31+97 == 66*31+66 == 2112`), and concatenating such blocks yields `2^n` distinct strings sharing one hash (40 characters ⇒ \u003e1,000,000 colliding keys). \nAll such keys route to a single `HashCollisionNode`, whose `get`/`update` walk the entire bucket testing `is()`. There is no per-process salt, so the colliding set is fully precomputable from the open-source algorithm.\n\n## Proof of concept\n\nInserting N colliding keys (e.g. via `Immutable.Map(obj)` / `Immutable.fromJS(obj)`) is O(N²). Measured on one machine, ~8,000 colliding\nkeys take ~0.7 s to build and ~0.6 s to read, scaling ×4 per doubling; ~16,000 keys exceed several seconds.\n\n## Impact\n\nCPU-bound denial of service in applications that ingest attacker-controlled object **keys** into Immutable structures, e.g. `Immutable.Map(req.body)`, `Immutable.fromJS(req.body)`, `state.merge(userObject)` / `mergeDeep(...)`. Applications that only store attacker input as **values** under fixed keys are not affected.\n\n## Affected versions\n\n- \u003e= 4.0.0-beta.1, \u003c 4.3.9\n- \u003e= 5.0.0-beta.1, \u003c 5.1.8\n- \u003c 3.8.4\n\n## Patches\n\nFixed in `5.1.8` _(adjust to the actual release)_: large collision buckets are indexed by a per-process **seeded** secondary hash, restoring near-linear behavior for the affected paths. The public `hash()` is unchanged (no breaking change), and `is()` remains the sole authority on key equality. Also fixed in 4.3.9 and 3.8.4.\n\n## Workarounds\n\nBefore passing untrusted data to Immutable.js: cap request body size, limit object key count/length, and reject high-cardinality payloads; avoid building Maps directly from untrusted object keys.\n\n## References\n\n- CWE-407 (Inefficient Algorithmic Complexity), CWE-400 (Uncontrolled Resource Consumption)\n- OWASP API4:2023 (Unrestricted Resource Consumption)","status":"published","published":"2026-07-21T19:02:33Z","modified":"2026-09-10T03:51:12.758661308Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"UBUNTU-CVE-2026-59880","description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","status":"published","published":"2026-07-08T16:16:00Z","modified":"2026-10-17T12:59:14.411786622Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1784769617","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 5.0.3-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.716470263Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856200","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.3.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.967518202Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856463","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.5-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:55.12615536Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943220","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.1.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:35.775910381Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943293","title":"TuxCare security update for immutable (1 CVE)","description":"TuxCare rebuilt immutable to address 1 CVE. Fixed in 3.8.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:35.806191253Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943404","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.8.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.117999215Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785117466","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.8.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:55.141046754Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790084679","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 5.1.5-tuxcare.1.","status":"published","published":"2026-09-22T13:44:39Z","modified":"2026-10-15T09:46:03.058398951Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790808099","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 3.7.6-tuxcare.1.","status":"published","published":"2026-09-30T22:41:39Z","modified":"2026-10-15T09:47:41.965792166Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792163804","title":"TuxCare security update for immutable (2 CVEs)","description":"TuxCare rebuilt immutable to address 2 CVEs. Fixed in 4.3.8-tuxcare.1.","status":"published","published":"2026-10-16T15:16:44Z","modified":"2026-10-16T16:31:59.763030212Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"ROOT-APP-NPM-CVE-2026-59880","title":"CVE-2026-59880 in immutable - Patched by Root","description":"Root has patched CVE-2026-59880 in the immutable package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:44:56Z","modified":"2026-10-07T15:16:05.374004795Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}