CVE-2026-59880 Details
Description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
A denial-of-service vulnerability has been identified in Immutable.js versions prior to 4.3.9 and 5.1.8. The issue arises in Immutable.Map and Immutable.Set, which handle keys with identical 32-bit hashes by placing them in a HashCollisionNode. This node is accessed through a linear scan, creating a performance bottleneck. An attacker can exploit this by crafting colliding keys, particularly when keys are derived from user-controlled objects. The vulnerability degrades the efficiency of insertion and lookup operations, causing excessive CPU consumption and disrupting the event loop in single-threaded environments like Node.js.
Users can upgrade to Immutable.js versions 4.3.9 or 5.1.8, where this vulnerability has been fixed. In these versions, large collision buckets are indexed using a per-process seeded hash, which significantly improves lookup performance under hash-flooding conditions.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| immutable-js immutable | < 4.3.9 >= 5.0.0, < 5.1.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |