CVE-2026-59879 Details

A denial-of-service vulnerability has been identified in the List component of Immutable.js, specifically in versions prior to 4.3.9 and 5.1.8. The issue arises in the handling of indices and sizes within the range of 2^30 to 2^31. The affected methods, including List#set, List#setSize, List#setIn, List#updateIn, and their functional counterparts, mismanage these values, leading to severe performance issues. An empty List can become stuck in an uncatchable infinite loop, while a populated List can cause unbounded memory allocation, eventually forcing the process to abort. Additionally, the List#setSize method can silently wrap large values, corrupting data without any indication of an error.

Users can upgrade to Immutable.js versions 4.3.9 or 5.1.8, where this vulnerability has been fixed. For those unable to upgrade immediately, it is recommended to validate and clamp any externally supplied List indices or key-path segments against a maximum limit before passing them to Immutable.js. Additionally, request handling can be managed in a worker that can be restarted, with the heap size capped to contain any potential process aborts.