CVE-2026-29063

Critical · CVSS 9.8

Immutable.js (immutable-js) — Prototype Pollution

CVSS: 9.8; nvd
EPSS: 0.98%; 59th pct
KEV: No
Class: oss containerizable; CWE-1321, CWE-915

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Search profile — drives PoC discovery

Symbols mergeDeepmergeDeepWithmergeMap.toJSMap.toObject__proto__constructor.prototype

Keywords CVE-2026-29063GHSA-wf6x-7x77-mvgwimmutable-js prototype pollutionimmutable mergeDeep prototype pollutionimmutable.js CWE-1321immutable.js CWE-915immutable Map.toJS pollutionimmutable mergeDeepWith exploitimmutable-js PoC

Versions: < 3.8.3, >= 4.0.0 < 4.3.7, >= 5.0.0 < 5.1.5

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

immutable-js/immutable-js candidate

cited in references

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

npm	immutable	0 → 3.8.3
npm	immutable	4.0.0-rc.1 → 4.3.8
npm	immutable	5.0.0 → 5.1.5

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T06:30:14.000Z