immutable vulnerabilities
CVEs whose affected-version data names the immutable package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-59880HighImmutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
▾ Twilightimmutable · immutableEPSS 0.57%via GHSA
CVE-2026-29063Critical· 9.8Immutable.js provides many Persistent Immutable data structures
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. …
▾ Midnightimmutable-js · immutableEPSS 0.98%via NVD