CVE-2026-29063: Immutable.js Prototype Pollution in merge and Map APIs

CVE-2026-29063 · Severity: critical · CVSS 9.8 · Published 2026-03-06

Immutable.js is a popular JavaScript library used to manage data structures in web and server-side applications. A vulnerability in how the library merges data allows attackers to inject malicious properties into application objects. This can lead to unauthorized privilege escalation, where an attacker could gain administrative access or bypass security checks by manipulating the application's internal data logic.

Technologies: Immutable.js, immutable (npm). Vendors: Immutable.js, npm.

Quick answers

Is CVE-2026-29063 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29063 being exploited in the wild.
How severe is CVE-2026-29063?
Critical severity, with a CVSS score of 9.8, published 6 March 2026.
Which products and versions are affected?
Immutable.js < 3.8.3, < 4.3.7, < 5.1.5; immutable (npm) SEMVER:introduced=4.0.0-rc.1,fixed=4.3.8.
Is there a fix for CVE-2026-29063?
Yes. immutable (npm): upgrade to 4.3.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29063 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-29063?
Check whether you run Immutable.js or immutable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • immutable (npm): upgrade to 4.3.8 or later
    npm install immutable@4.3.8

Technical details

A Prototype Pollution vulnerability exists in Immutable.js due to improper validation of keys such as '__proto__' during object manipulation. Specifically, the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs fail to guard against prototype attributes when converting or merging data structures. An attacker can provide a specially crafted JSON payload containing a '__proto__' property; when processed by these functions, the library may modify the prototype of the resulting object. This can be exploited to inject properties that bypass security logic (e.g., setting an 'admin' flag to true) or alter application behavior. The issue is fixed in versions 3.8.3, 4.3.7, and 5.1.5.

Affected products

  • Immutable.js Immutable.js < 3.8.3, < 4.3.7, < 5.1.5

Identifiers

  • CVE-2026-29063
  • GHSA-wf6x-7x77-mvgw

Timeline

  • 2026-03-03: advisory: GitHub Security Advisory published
  • 2026-03-03: patched: Versions 4.3.8 and 5.1.5 released
  • 2026-03-06: disclosed: CVE-2026-29063 published to NVD
  • 2026-03-06: patched: Version 3.8.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.