Npm · Immutable-Js · CVE-2026-59879
**Name of the Vulnerable Software and Affected Versions**
Immutable.js versions prior to 4.3.9
Immutable.js versions prior to 5.1.8
**Description**
Certain functions mishandle an index or size within the range 2 ** 30 to 2 ** 31 in the `setListBounds` function located in `src/List.js`. This can lead to an empty List entering an uncatchable infinite loop, a populated List allocating memory without bound until the process aborts, or the `setSize` function silently wrapping large values. The affected functions include `List#set`, `List#setSize`, `List#setIn`, `List#updateIn`, and the functional `set`, `setIn`, and `updateIn`.
**Recommendations**
Update Immutable.js to version 4.3.9 or later.
Update Immutable.js to version 5.1.8 or later.