CVE-2026-59879
Fixed in a distro release EPSS <1%CVSS 8.7
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
Products: immutable-js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | immutable | 4.3.9 |
| npm | immutable | 5.1.8 |
| npm | immutable | 3.8.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.5-r13 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r26 |
| Chainguard | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Chainguard | authentik-2025.12 | no fix |
| Chainguard | authentik-2026.2 | 2026.2.6-r11 |
| Chainguard | authentik-2026.5 | 2026.5.6-r3 |
| Chainguard | authentik-2026.5 | 2026.5.6-r4 |
| Chainguard | authentik-fips-2025.12 | no fix |
| Chainguard | authentik-fips-2026.5 | 2026.5.6-r3 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | keep-ui | 0.54.2-r3 |
| Chainguard | keep-ui-fips | 0.54.2-r5 |
| Chainguard | nextcloud-server-33 | 33.0.7-r1 |
| Chainguard | nextcloud-server-34 | 34.0.2-r7 |
| Chainguard | rancher-api-ui | 1.2.3-r9 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-23 | 23.0.5-r6 |
| Chainguard | vitess-24 | 24.0.2-r7 |
| Chainguard | vitess-24-compat | 24.0.3-r7 |
| Debian 12 | node-immutable | no fix |
| Debian 13 | node-immutable | no fix |
| Debian 14 | node-immutable | 4.3.9-1 |
| Red Hat satellite 6.19 | foreman | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-cli | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-debug | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-dynflow-sidekiq | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-ec2 | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-journald | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-libvirt | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-openstack | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-pcp | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-postgresql | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-redis | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-service | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-telemetry | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | foreman-vmware | 0:3.18.0.14-1.el9sat |
| Red Hat satellite 6.19 | python3.12-dynaconf | 0:3.2.13-2.el9pc |
| Red Hat satellite 6.19 | python3.12-gitpython | 0:3.1.62-1.el9pc |
| Red Hat satellite 6.19 | python3.12-sqlparse | 0:0.6.0-1.el9pc |
| Red Hat satellite 6.19 | rubygem-foreman_remote_execution | 0:16.5.3-2.el9sat |
| Red Hat satellite 6.19 | rubygem-foreman_remote_execution-cockpit | 0:16.5.3-2.el9sat |
| Red Hat satellite 6.19 | rubygem-hammer_cli | 0:3.18.0-2.el9sat |
| Red Hat satellite 6.19 | rubygem-katello | 0:4.20.0.11-1.el9sat |
| Red Hat satellite 6.19 | yggdrasil-worker-forwarder | 0:0.1.0-2.1.el9sat |
| Red Hat satellite capsule 6.19 | foreman | 0:3.18.0.14-1.el9sat |
| Red Hat satellite capsule 6.19 | foreman-debug | 0:3.18.0.14-1.el9sat |
| Red Hat satellite capsule 6.19 | foreman-pcp | 0:3.18.0.14-1.el9sat |
| Red Hat satellite capsule 6.19 | python3.12-dynaconf | 0:3.2.13-2.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-gitpython | 0:3.1.62-1.el9pc |
| Red Hat satellite capsule 6.19 | python3.12-sqlparse | 0:0.6.0-1.el9pc |
| Red Hat satellite utils 6.19 | foreman | 0:3.18.0.14-1.el9sat |
| Red Hat satellite utils 6.19 | foreman-cli | 0:3.18.0.14-1.el9sat |
| Red Hat satellite utils 6.19 | rubygem-hammer_cli | 0:3.18.0-2.el9sat |
| Ubuntu 20.04 LTS | node-immutable | no fix |
| Ubuntu 22.04 LTS | node-immutable | no fix |
| Ubuntu 24.04 LTS | node-immutable | no fix |
| Ubuntu 25.10 | node-immutable | no fix |
| Ubuntu 26.04 LTS | node-immutable | no fix |
| Ubuntu 26.10 | node-immutable | no fix |
| Wolfi | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Wolfi | nextcloud-server-33 | 33.0.7-r1 |
| Wolfi | rancher-api-ui | 1.2.3-r9 |
| Wolfi | vitess-23 | 23.0.5-r6 |
| Wolfi | vitess-24 | 24.0.2-r7 |
| Wolfi | vitess-24-compat | 24.0.3-r7 |