Executive brief
Immutable.js is a popular library used to manage data efficiently in JavaScript applications. A vulnerability in how it handles data keys allows an attacker to send specially crafted information that forces the application to perform excessive calculations. This can lead to a denial-of-service (DoS) condition, where the application becomes unresponsive or crashes, potentially disrupting business operations and customer access.
Technical details
Immutable.js Map and Set structures are vulnerable to a Hash-collision algorithmic complexity attack (CWE-407). The library uses a deterministic 32-bit string hashing algorithm without a per-process salt, allowing attackers to precompute keys that collide into the same bucket. These collisions are handled via linear scanning, degrading performance from O(1) to O(n) for single operations and O(n²) for bulk operations. In single-threaded environments like Node.js, this can stall the event loop and cause a Denial of Service. The issue is fixed in versions 4.3.9 and 5.1.8 by introducing a per-process seeded secondary hash for large collision buckets.
Affected products
- Immutable.js immutable-js < 4.3.9, >= 5.0.0-beta.1, < 5.1.8
Timeline
- 2026-06-25: disclosed: Initial disclosure to maintainers
- 2026-07-08: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published