CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

View on CVE.org
Published Mar 6, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:11070 cve-icon
https://access.redhat.com/errata/RHSA-2026:11217 cve-icon
https://access.redhat.com/errata/RHSA-2026:11414 cve-icon
https://access.redhat.com/errata/RHSA-2026:11858 cve-icon
https://access.redhat.com/errata/RHSA-2026:11916 cve-icon
https://access.redhat.com/errata/RHSA-2026:12118 cve-icon
https://access.redhat.com/errata/RHSA-2026:13542 cve-icon
https://access.redhat.com/errata/RHSA-2026:13548 cve-icon
https://access.redhat.com/errata/RHSA-2026:13791 cve-icon
https://access.redhat.com/errata/RHSA-2026:13826 cve-icon
https://access.redhat.com/errata/RHSA-2026:13829 cve-icon
https://access.redhat.com/errata/RHSA-2026:13847 cve-icon
https://access.redhat.com/errata/RHSA-2026:13853 cve-icon
https://access.redhat.com/errata/RHSA-2026:17469 cve-icon
https://access.redhat.com/errata/RHSA-2026:17598 cve-icon
https://access.redhat.com/errata/RHSA-2026:19375 cve-icon
https://access.redhat.com/errata/RHSA-2026:19409 cve-icon
https://access.redhat.com/errata/RHSA-2026:19410 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:20034 cve-icon
https://access.redhat.com/errata/RHSA-2026:20041 cve-icon
https://access.redhat.com/errata/RHSA-2026:20042 cve-icon
https://access.redhat.com/errata/RHSA-2026:20088 cve-icon
https://access.redhat.com/errata/RHSA-2026:21657 cve-icon
https://access.redhat.com/errata/RHSA-2026:21658 cve-icon
https://access.redhat.com/errata/RHSA-2026:21703 cve-icon
https://access.redhat.com/errata/RHSA-2026:21931 cve-icon
https://access.redhat.com/errata/RHSA-2026:22465 cve-icon
https://access.redhat.com/errata/RHSA-2026:23246 cve-icon
https://access.redhat.com/errata/RHSA-2026:24473 cve-icon
https://access.redhat.com/errata/RHSA-2026:24977 cve-icon
https://access.redhat.com/errata/RHSA-2026:26225 cve-icon
https://access.redhat.com/errata/RHSA-2026:26232 cve-icon
https://access.redhat.com/errata/RHSA-2026:27063 cve-icon
https://access.redhat.com/errata/RHSA-2026:28893 cve-icon
https://access.redhat.com/errata/RHSA-2026:28964 cve-icon
https://access.redhat.com/errata/RHSA-2026:29857 cve-icon
https://access.redhat.com/errata/RHSA-2026:29864 cve-icon
https://access.redhat.com/errata/RHSA-2026:34049 cve-icon
https://access.redhat.com/errata/RHSA-2026:34099 cve-icon
https://access.redhat.com/errata/RHSA-2026:34100 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:36621 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36882 cve-icon
https://access.redhat.com/errata/RHSA-2026:40022 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40984 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41941 cve-icon
https://access.redhat.com/errata/RHSA-2026:41944 cve-icon
https://access.redhat.com/errata/RHSA-2026:6428 cve-icon
https://access.redhat.com/errata/RHSA-2026:6568 cve-icon
https://access.redhat.com/errata/RHSA-2026:6720 cve-icon
https://access.redhat.com/errata/RHSA-2026:6926 cve-icon
https://access.redhat.com/errata/RHSA-2026:7329 cve-icon
https://access.redhat.com/errata/RHSA-2026:8218 cve-icon
https://access.redhat.com/errata/RHSA-2026:8483 cve-icon
https://access.redhat.com/errata/RHSA-2026:8484 cve-icon
https://access.redhat.com/errata/RHSA-2026:8490 cve-icon
https://access.redhat.com/errata/RHSA-2026:8491 cve-icon
https://access.redhat.com/errata/RHSA-2026:8493 cve-icon
https://access.redhat.com/errata/RHSA-2026:9742 cve-icon
https://access.redhat.com/errata/RHSA-2026:9848 cve-icon
https://access.redhat.com/security/cve/CVE-2026-29063 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2445291 cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-29063 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-29063 cve-icon
History
Type Values Removed Values Added
First Time appeared Redhat
Redhat 3scale Api Management Platform
Redhat advanced Cluster Management For Kubernetes
Redhat advanced Cluster Security
Redhat ansible Automation Platform
Redhat build Of Apicurio Registry
Redhat connectivity Link
Redhat developer Hub
Redhat discovery
Redhat edge Manager
Redhat enterprise Linux
Redhat logging Subsystem For Red Hat Openshift
Redhat migration Toolkit
Redhat migration Toolkit For Virtualization
Redhat multicluster Engine For Kubernetes
Redhat network Observability Operator
Redhat openshift Cluster Observability Operator
Redhat openshift Container Platform
Redhat openshift Data Foundation
Redhat openshift Gitops
Redhat openshift Lightspeed
Redhat openshift Pipelines
Redhat openshift Service Mesh
Redhat openshift Virtualization
Redhat quay
Redhat satellite
Redhat self-service Automation Portal
CPEs cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernetes:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_apicurio_registry:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:connectivity_link:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:developer_hub:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:edge_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit:1.8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:network_observability_operator:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:network_observability_operator:1.12.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_cluster_observability_operator:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:4.17:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_pipelines:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:2.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:3.18.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*
cpe:2.3:a:redhat:self-service_automation_portal:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Redhat
Redhat 3scale Api Management Platform
Redhat advanced Cluster Management For Kubernetes
Redhat advanced Cluster Security
Redhat ansible Automation Platform
Redhat build Of Apicurio Registry
Redhat connectivity Link
Redhat developer Hub
Redhat discovery
Redhat edge Manager
Redhat enterprise Linux
Redhat logging Subsystem For Red Hat Openshift
Redhat migration Toolkit
Redhat migration Toolkit For Virtualization
Redhat multicluster Engine For Kubernetes
Redhat network Observability Operator
Redhat openshift Cluster Observability Operator
Redhat openshift Container Platform
Redhat openshift Data Foundation
Redhat openshift Gitops
Redhat openshift Lightspeed
Redhat openshift Pipelines
Redhat openshift Service Mesh
Redhat openshift Virtualization
Redhat quay
Redhat satellite
Redhat self-service Automation Portal
Type Values Removed Values Added
First Time appeared Immutable-js immutable
CPEs cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
Vendors & Products Immutable-js immutable
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Weaknesses CWE-915
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important
Type Values Removed Values Added
First Time appeared Immutable-js
Immutable-js immutable-js
Vendors & Products Immutable-js
Immutable-js immutable-js
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Title Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Sep 10, 2026, 12:05 PM
Reserved
Mar 3, 2026, 8:51 PM

View source JSON

Updated
Sep 10, 2026, 12:05 PM

JSON

Status
Analyzed
Published
Mar 6, 2026, 7:16 PM
Modified
Oct 30, 2026, 1:16 PM

View source JSON

Severity
Important
Public date
Mar 6, 2026, 6:25 PM

View source Bugzilla JSON

Updated
Apr 16, 2026, 11:30 AM

JSON