Which versions of Immutable.js are affected by EUVD-2026-42315?

Immutable.js versions before 4.3.9 and 5.1.8 contain a denial-of-service vulnerability allowing unauthenticated attackers to exhaust server CPU through hash collision attacks on Map and Set…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-42315?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42315. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-42315?

Within 24 hours: Audit all applications and dependencies to identify use of Immutable.js and current installed versions. Within 7 days: Update to Immutable.js 4.3.9 (for 4.x branch) or 5.1.8+ (for 5.x branch) in development and staging environments and complete testing. Within 30 days: Deploy patched versions to all production systems and verify no instances of versions prior to 4.3.9 or 5.1.8 remain in operation.

Immutable.js EUVD-2026-42315

Q: What is the CVSS score of EUVD-2026-42315?

EUVD-2026-42315 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-59880 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-07-08 GitHub_M

GHSA-xvcm-6775-5m9r

Information Disclosure Immutable Js

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Untrusted keys can reach Map/Set over the network without auth or interaction (AV:N/PR:N/UI:N), collisions are easy to craft against a known hash (AC:L), and impact is CPU-exhaustion DoS only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 17:01 EUVD

Analysis Generated

Jul 08, 2026 - 16:33 vuln.today

DescriptionCVE.org

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.

AnalysisAI

Uncontrolled resource consumption in Immutable.js prior to 4.3.9 and 5.1.8 lets an attacker who controls keys inserted into an Immutable.Map or Immutable.Set exhaust CPU by supplying many keys that share the same 32-bit hash. Because collisions are stored in a HashCollisionNode bucket that is scanned linearly, insertion and lookup degrade from near-constant to quadratic time, producing a denial of service. No public exploit identified at time of analysis and no active exploitation is indicated, but the CVSS 4.0 score of 8.7 reflects an easy, unauthenticated, network-reachable availability impact wherever user-supplied objects reach these structures.

Technical ContextAI

Immutable.js is a widely used JavaScript library providing persistent immutable data structures (Map, Set, List, etc.), commonly paired with React/Redux on the front end and Node.js on the server. Internally, Map/Set use a Hash Array Mapped Trie (HAMT) keyed on a 32-bit hash of each key. When two distinct keys produce the same 32-bit hash they are placed together in a HashCollisionNode, whose entries are compared one-by-one in a linear scan. This is a textbook CWE-407 (Inefficient/Excessive Algorithmic Complexity) issue: the average O(1) hash-lookup guarantee collapses to O(n) per operation within a collision bucket, so an attacker who can predict or reproduce the hash function can deliberately manufacture large numbers of colliding keys. The affected component is the immutable-js package itself (cpe:2.3:a:immutable-js:immutable-js), and any ingestion path that turns external input into keys - Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep - is a trigger surface.

RemediationAI

Upgrade Immutable.js to 4.3.9 (4.x users) or 5.1.8 (5.x users), the vendor-released patched versions per GitHub releases v4.3.9 and v5.1.8 and advisory GHSA-xvcm-6775-5m9r; also update any transitive dependencies that pin an older immutable version by adjusting the lockfile or using npm overrides. If you cannot upgrade immediately, reduce the attack surface by not building Map/Set keys directly from untrusted input: avoid passing raw user objects to Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, and instead validate, whitelist, or bound the number of keys accepted from external sources (trade-off: added input-handling code and possible rejection of legitimate large payloads). Enforcing request size and field-count limits plus per-request CPU/time budgets at the API gateway or application layer also blunts the DoS, at the cost of tuning thresholds so they do not break legitimate heavy workloads.