CVE-2026-59880
Fixed in a distro release EPSS <1%CVSS 8.7
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
Products: immutable-js
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | immutable | 4.3.9 |
| npm | immutable | 5.1.8 |
| npm | immutable | 3.8.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.5-r13 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r26 |
| Chainguard | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Chainguard | authentik-2025.12 | no fix |
| Chainguard | authentik-2026.2 | 2026.2.6-r11 |
| Chainguard | authentik-2026.5 | 2026.5.6-r3 |
| Chainguard | authentik-2026.5 | 2026.5.6-r4 |
| Chainguard | authentik-fips-2025.12 | no fix |
| Chainguard | authentik-fips-2026.5 | 2026.5.6-r3 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | keep-ui | 0.54.2-r3 |
| Chainguard | keep-ui-fips | 0.54.2-r5 |
| Chainguard | nextcloud-server-33 | 33.0.7-r1 |
| Chainguard | nextcloud-server-34 | 34.0.2-r7 |
| Chainguard | rancher-api-ui | 1.2.3-r9 |
| Chainguard | vitess-22 | no fix |
| Chainguard | vitess-23 | 23.0.5-r6 |
| Chainguard | vitess-24 | 24.0.2-r7 |
| Chainguard | vitess-24-compat | 24.0.3-r7 |
| Debian 12 | node-immutable | no fix |
| Debian 13 | node-immutable | no fix |
| Debian 14 | node-immutable | 4.3.9-1 |
| Ubuntu 20.04 LTS | node-immutable | no fix |
| Ubuntu 22.04 LTS | node-immutable | no fix |
| Ubuntu 24.04 LTS | node-immutable | no fix |
| Ubuntu 25.10 | node-immutable | no fix |
| Ubuntu 26.04 LTS | node-immutable | no fix |
| Ubuntu 26.10 | node-immutable | no fix |
| Wolfi | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Wolfi | nextcloud-server-33 | 33.0.7-r1 |
| Wolfi | rancher-api-ui | 1.2.3-r9 |
| Wolfi | vitess-23 | 23.0.5-r6 |
| Wolfi | vitess-24 | 24.0.2-r7 |
| Wolfi | vitess-24-compat | 24.0.3-r7 |