# CVE-2026-59880: Immutable.js denial of service via hash collision in Map and Set

Source: https://junglewise.ai/threats/cve-2026-59880-immutable-js-denial-of-service-via-hash-collision-in-map-and-set  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59880 · Severity: high · CVSS 4 · Published 2026-07-08

Immutable.js is a popular library used to manage data efficiently in JavaScript applications. A vulnerability in how it handles data keys allows an attacker to send specially crafted information that forces the application to perform excessive calculations. This can lead to a denial-of-service (DoS) condition, where the application becomes unresponsive or crashes, potentially disrupting business operations and customer access.

Technologies: [Immutable.js](https://junglewise.ai/threats/technologies/immutable-js), [immutable (npm)](https://junglewise.ai/threats/technologies/immutable). Vendors: [Immutable.js](https://junglewise.ai/threats/vendors/immutable-js), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-59880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59880 being exploited in the wild.

**How severe is CVE-2026-59880?** High severity, with a CVSS score of 4, published 8 July 2026.

**Which products and versions are affected?** Immutable.js < 4.3.9, >= 5.0.0-beta.1 < 5.1.8, < 4.3.9, >= 5.0.0-beta.1, < 5.1.8; immutable (npm) SEMVER:introduced=4.0.0-beta.1,fixed=4.3.9.

**Is there a fix for CVE-2026-59880?** Yes. immutable (npm): upgrade to 4.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59880 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59880?** Check whether you run Immutable.js or immutable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- immutable (npm): upgrade to 4.3.9 or later

  ```sh
  npm install immutable@4.3.9
  ```


## Technical details

Immutable.js Map and Set structures are vulnerable to a Hash-collision algorithmic complexity attack (CWE-407). The library uses a deterministic 32-bit string hashing algorithm without a per-process salt, allowing attackers to precompute keys that collide into the same bucket. These collisions are handled via linear scanning, degrading performance from O(1) to O(n) for single operations and O(n²) for bulk operations. In single-threaded environments like Node.js, this can stall the event loop and cause a Denial of Service. The issue is fixed in versions 4.3.9 and 5.1.8 by introducing a per-process seeded secondary hash for large collision buckets.

## Affected products

- Immutable.js immutable-js < 4.3.9, >= 5.0.0-beta.1, < 5.1.8

## Identifiers

- CVE-2026-59880
- GHSA-xvcm-6775-5m9r

## Timeline

- 2026-06-25: disclosed: Initial disclosure to maintainers
- 2026-07-08: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/nvth](https://api.github.com/users/nvth)
- [https://github.com/nvth](https://github.com/nvth)
- [https://api.github.com/users/nvth/gists%7B/gist_id%7D](https://api.github.com/users/nvth/gists%7B/gist_id%7D)
- [https://api.github.com/users/nvth/repos](https://api.github.com/users/nvth/repos)
- [https://avatars.githubusercontent.com/u/63294758?v=4](https://avatars.githubusercontent.com/u/63294758?v=4)
- [https://api.github.com/users/nvth/events%7B/privacy%7D](https://api.github.com/users/nvth/events%7B/privacy%7D)

## Related threats

- [Immutable.js denial of service via integer overflow in List component](https://junglewise.ai/threats/cve-2026-59879-immutable-js-denial-of-service-via-integer-overflow-in-list)
- [Immutable.js Prototype Pollution in merge and Map APIs](https://junglewise.ai/threats/cve-2026-29063-immutable-js-prototype-pollution-in-merge-and-map-apis)