Junglewise Threat Intelligence

CVE-2026-29063: Immutable.js Prototype Pollution in merge and Map APIs

CVE-2026-29063 · Severity: critical · CVSS 9.8 · Published 2026-03-06

Technologies: Immutable.js. Vendors: Immutable.js.

Executive brief

Immutable.js is a popular JavaScript library used to manage data structures in web and server-side applications. A vulnerability in how the library merges data allows attackers to inject malicious properties into application objects. This can lead to unauthorized privilege escalation, where an attacker could gain administrative access or bypass security checks by manipulating the application's internal data logic.

Technical details

A Prototype Pollution vulnerability exists in Immutable.js due to improper validation of keys such as '__proto__' during object manipulation. Specifically, the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs fail to guard against prototype attributes when converting or merging data structures. An attacker can provide a specially crafted JSON payload containing a '__proto__' property; when processed by these functions, the library may modify the prototype of the resulting object. This can be exploited to inject properties that bypass security logic (e.g., setting an 'admin' flag to true) or alter application behavior. The issue is fixed in versions 3.8.3, 4.3.7, and 5.1.5.

Affected products

  • Immutable.js Immutable.js < 3.8.3, < 4.3.7, < 5.1.5

Timeline

  • 2026-03-03: advisory: GitHub Security Advisory published
  • 2026-03-03: patched: Versions 4.3.8 and 5.1.5 released
  • 2026-03-06: disclosed: CVE-2026-29063 published to NVD
  • 2026-03-06: patched: Version 3.8.3 released

References

Related threats