Threat Advisory

Immutable.js Hash Collision Vulnerabilities Cause DoS

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the npm/immutable library versions prior to 4.3.9 and 5.1.8. These flaws include algorithmic complexity denial-of-service issues stemming from hash collisions in Map and Set structures, as well as a critical integer overflow vulnerability in the List data structure. Attackers can exploit these weaknesses by supplying maliciously crafted input or specific index ranges to trigger excessive CPU consumption, infinite loops, or unbounded memory allocation. Successful exploitation poses a significant business risk by causing application crashes, stalling server event loops, and potentially leading to widespread service outages for applications processing untrusted user data.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the npm/immutable library versions prior to 4.3.9 and 5.1.8. These flaws include algorithmic complexity denial-of-service issues stemming from hash collisions in Map and Set structures, as well as a critical integer overflow vulnerability in the List data structure. Attackers can exploit these weaknesses by supplying maliciously crafted input or specific index ranges to trigger excessive CPU consumption, infinite loops, or unbounded memory allocation. Successful exploitation poses a significant business risk by causing application crashes, stalling server event loops, and potentially leading to widespread service outages for applications processing untrusted user data.[emaillocker id="1283"]

  • CVE-2026-59880 with a CVSS score of 7.5 – This vulnerability allows remote attackers to cause a denial of service via hash collision attacks where crafted keys degrade Map and Set operations to quadratic time complexity. By controlling object keys inserted into Immutable structures, an unauthenticated attacker can exhaust CPU resources and stall application processes without requiring any privileges.
    • CVE-2026-59879 with a CVSS score of 7.5 – This flaw enables an attacker to trigger an unrecoverable denial of service by passing specific large index values to List operations such as set, setSize, or setIn. Exploitation requires no user interaction or privileges and causes infinite loops or process termination due to heap exhaustion when untrusted input is routed into List indices.

Exploitation of these vulnerabilities poses a high risk of service disruption, potentially allowing a single malicious request to crash critical application servers. The impact on availability is severe, as successful attacks can halt processing entirely or cause silent data corruption, leading to operational downtime and loss of user trust. Organizations utilizing this library to process external input must treat this situation with high urgency to prevent persistent outages.

RECOMMENDATION:

  • We recommend you to update npm package immutable to version 5.1.8.

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-xvcm-6775-5m9r
https://github.com/advisories/GHSA-v56q-mh7h-f735

[/emaillocker]
crossmenu