CVE-2026-29063 Details

A prototype pollution vulnerability has been identified in Immutable.js versions prior to 3.8.3, 4.3.7, and 5.1.5. This vulnerability allows for the improper modification of object prototype attributes through several APIs, including mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(). The issue arises because these methods do not properly guard against prototype pollution, enabling attackers to inject malicious properties that can be exploited, such as bypassing security checks related to user roles or privileges.

Users can upgrade to Immutable.js versions 3.8.3, 4.3.7, or 5.1.5 to address this vulnerability. For those unable to upgrade, validating user input to remove or neutralize __proto__ keys, using the Node.js flag --disable-proto to disable prototype manipulation, locking down built-in objects to prevent prototype pollution, avoiding lookups on the prototype, or creating JavaScript objects with a null prototype can serve as temporary workarounds.