Immutable.js CVE-2026-59879

Exploitation requires that the target application pass an attacker-influenced numeric value in the range 2^30 to 2^31 (approximately 1,073,741,824 to 2,147,483,647) into one of the affected APIs: List#set, List#setSize, List#setIn, List#updateIn, or the functional set/setIn/updateIn. The concrete trigger is the index/size argument reaching setListBounds in src/List.js. Limiting factors: the vulnerable value must reach one of those specific methods, so an application that never forwards untrusted numbers as List indices/sizes is not exploitable; the empty-List infinite-loop variant and the populated-List allocation variant depend on List state; and only availability is affected - there is no data disclosure or code execution. No authentication is modeled in the vendor CVSS (PR:N), but reachability is entirely dependent on non-default application code paths rather than any Immutable.js configuration setting.

The signals are internally consistent but modest in real-world urgency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.7 (High) driven entirely by the VA:H availability impact - there is no confidentiality or integrity effect. There is no EPSS score, no CISA KEV listing, and no published proof-of-concept in the provided data, so this is a high-CVSS availability bug rather than a confirmed high-real-risk exploited vulnerability. Crucially, exploitability is conditional on application design: because this is a library, an attacker can only reach the flaw if the host application passes attacker-controllable index/size values (e.g. a request parameter used as a List index or size) into the affected APIs. Where that data flow does not exist, real-world risk is near zero despite the 8.7 score. The vendor vector's PR:N/AC:L reflects worst-case library-internal reachability; defenders should treat AC as effectively higher given the specific numeric range and required code path.

An application uses Immutable.js and passes a user-supplied number - for example a pagination size, array index, or JSON field - into List#setSize or List#set. An attacker submits a value such as 1073741824 (2^30), and on an empty List the process enters an uncatchable infinite loop or, on a populated List, allocates memory until the Node.js process aborts, taking down the service. No authentication is required at the CVSS level and no published PoC is currently available, but the attack is trivial where such a data path exists.