CVE-2026-59879

Name of the Vulnerable Software and Affected Versions Immutable.js versions prior to 4.3.9 Immutable.js versions prior to 5.1.8

Description Certain functions mishandle an index or size within the range 2 ** 30 to 2 ** 31 in the setListBounds function located in src/List.js. This can lead to an empty List entering an uncatchable infinite loop, a populated List allocating memory without bound until the process aborts, or the setSize function silently wrapping large values. The affected functions include List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn.

Recommendations Update Immutable.js to version 4.3.9 or later. Update Immutable.js to version 5.1.8 or later.