Skip to main content

Immutable.js EUVDEUVD-2026-42318

| CVE-2026-59879 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-07-08 GitHub_M GHSA-v56q-mh7h-f735
Denial Of Service Integer Overflow Red Hat Suse Immutable Js
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Availability-only DoS reachable over the network with no auth or interaction when the app forwards untrusted numbers; scope unchanged, no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 18:02 EUVD
Analysis Generated
Jul 08, 2026 - 16:56 vuln.today

DescriptionCVE.org

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 30 to 2 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

AnalysisAI

Denial of service in the Immutable.js JavaScript library (versions before 4.3.9 and 5.1.8) allows attackers who can influence an index or size value to crash or hang a Node.js/browser process. Passing a value between 2^30 and 2^31 to List#set, setSize, setIn, updateIn (or the functional equivalents) drives setListBounds into an uncatchable infinite loop on empty Lists, unbounded memory allocation until process abort on populated Lists, or a silent integer wrap on setSize. No public exploit code has been identified at time of analysis, and the flaw is not on the CISA KEV list; impact is availability-only.

Technical ContextAI

Immutable.js is a very widely used npm package providing persistent immutable collections (List, Map, Set, etc.) for JavaScript, commonly embedded in React/Redux front ends and Node.js services. The root cause is CWE-190 (Integer Overflow or Wraparound) inside setListBounds in src/List.js: internal index/size arithmetic assumes values stay within the array-safe range, but values in the range 2^30 to 2^31 break the bounds-computation loop and capacity handling. Because JavaScript numbers and the library's internal 32-bit tree-shift math (Lists are backed by a trie of 32-wide nodes) are involved, an out-of-range index either never satisfies the loop's termination condition (infinite loop) or forces the structure to grow node-by-node without bound (memory exhaustion). The affected component is identified in CPE as cpe:2.3:a:immutable-js:immutable-js.

RemediationAI

Upgrade to Vendor-released patch: 4.3.9 (for 4.x deployments) or 5.1.8 (for 5.x deployments); the fixes are in commits a1a1ee412dcaa380ab325196283d06594ffe4b84 and f0bc997d8eb9886aff2236635aa210a95a04304a and are referenced in advisory GHSA-v56q-mh7h-f735. Because this is a transitive dependency in many builds, run npm/yarn dependency resolution (e.g. npm ls immutable, then update lockfiles) to ensure the patched version is actually resolved rather than a cached vulnerable copy. Where immediate upgrade is not possible, add input validation at the application boundary so that any user-influenced value used as a List index or size is bounds-checked and rejected if it reaches or exceeds 2^30 (roughly 1,073,741,824); this is the specific compensating control, with the trade-off that it must be applied at every call site that forwards untrusted numbers into set, setSize, setIn, updateIn, or the functional set/setIn/updateIn helpers, and it does nothing for internally-computed sizes.

More in Immutable Js

View all
CVE-2026-59880 HIGH POC
8.7 Jul 08

Uncontrolled resource consumption in Immutable.js prior to 4.3.9 and 5.1.8 lets an attacker who controls keys inserted i
CVE-2026-29063 HIGH
8.7 Mar 06

Immutable.js provides many Persistent Immutable data structures. versions up to 3.8.3 is affected by improperly controll

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected

Share

EUVD-2026-42318 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy