CVE-2026-59880

Name of the Vulnerable Software and Affected Versions Immutable.js versions prior to 4.3.9 Immutable.js versions prior to 5.1.8

Description Immutable.Map and Immutable.Set store keys with identical 32-bit hashes in a HashCollisionNode collision bucket that is scanned linearly. An attacker capable of controlling keys inserted into a Map—via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep—can craft numerous colliding keys. This results in degraded insertion and lookup performance, leading to disproportionate CPU consumption.

Recommendations Update to version 4.3.9 or later. Update to version 5.1.8 or later.