Nvth

**Name of the Vulnerable Software and Affected Versions** Immutable.js versions prior to 4.3.9 Immutable.js versions prior to 5.1.8 **Description** Immutable.Map and Immutable.Set store keys with identical 32-bit hashes in a HashCollisionNode collision bucket that is scanned linearly. An attacker capable of controlling keys inserted into a Map—via `Immutable.Map(obj)`, `Immutable.fromJS(obj)`, `state.merge(userObject)`, or `mergeDeep`—can craft numerous colliding keys. This results in degraded insertion and lookup performance, leading to disproportionate CPU consumption. **Recommendations** Update to version 4.3.9 or later. Update to version 5.1.8 or later.