High severity · published Jul 8, 2026
CVE-2026-59879
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
immutable-js · immutable-js
>= 5.0.0-beta.1, < 5.1.8; < 4.3.9 · source: vendor
IM
Immutable · Immutable-js
before 4.3.9; 5.0.0 before 5.1.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59879
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59879
Patch
https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84
Patch
https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a
Product
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9
Product
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8
Exploit
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735
More from immutable-js
9.8
CVE-2026-29063
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
7.5
CVE-2026-59880
Immutable.js: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set