Critical severity9.8NVD Advisory· Published Mar 6, 2026· Updated Sep 10, 2026
CVE-2026-29063
CVE-2026-29063
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
immutablenpm | >= 4.0.0-rc.1, < 4.3.8 | 4.3.8 |
immutablenpm | >= 5.0.0, < 5.1.5 | 5.1.5 |
immutablenpm | < 3.8.3 | 3.8.3 |
Affected products
38- osv-coords37 versionspkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/argo-workflows-ui-3.6pkg:apk/chainguard/argo-workflows-ui-3.7pkg:apk/chainguard/argo-workflows-ui-4.0pkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/katib-earlystoppingpkg:apk/chainguard/katib-suggestion-hyperbandpkg:apk/chainguard/katib-suggestion-hyperoptpkg:apk/chainguard/katib-suggestion-nas-dartspkg:apk/chainguard/katib-suggestion-nas-enaspkg:apk/chainguard/katib-suggestion-optuna-enaspkg:apk/chainguard/katib-suggestion-pbt-enaspkg:apk/chainguard/katib-suggestion-skopt-enaspkg:apk/chainguard/katib-tfevent-metricscollectorpkg:apk/chainguard/rancher-api-uipkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-23pkg:apk/wolfi/argo-workflows-ui-3.7pkg:apk/wolfi/argo-workflows-ui-4.0pkg:apk/wolfi/katib-earlystoppingpkg:apk/wolfi/katib-suggestion-hyperbandpkg:apk/wolfi/katib-suggestion-hyperoptpkg:apk/wolfi/katib-suggestion-nas-dartspkg:apk/wolfi/katib-suggestion-nas-enaspkg:apk/wolfi/katib-suggestion-optuna-enaspkg:apk/wolfi/katib-suggestion-pbt-enaspkg:apk/wolfi/katib-suggestion-skopt-enaspkg:apk/wolfi/katib-tfevent-metricscollectorpkg:apk/wolfi/rancher-api-uipkg:apk/wolfi/vitess-22pkg:apk/wolfi/vitess-23pkg:npm/immutable
< 3.11.14.5-r13+ 36 more
- (no CPE)range: < 3.11.14.5-r13
- (no CPE)range: < 3.12.9.4-r26
- (no CPE)range: < 3.6.19-r3
- (no CPE)range: < 3.7.10-r4
- (no CPE)range: < 4.0.1-r4
- (no CPE)range: < 2026.2.5-r4
- (no CPE)range: < 2026.2.4-r11
- (no CPE)range: < 19.0.3-r1
- (no CPE)range: < 19.3.1-r6
- (no CPE)range: < 19.1.1-r1
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 1.2.3-r6
- (no CPE)range: < 22.0.4-r6
- (no CPE)range: < 23.0.3-r7
- (no CPE)range: < 3.7.10-r4
- (no CPE)range: < 4.0.1-r4
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 1.2.3-r6
- (no CPE)range: < 22.0.4-r6
- (no CPE)range: < 23.0.3-r7
- (no CPE)range: >= 4.0.0-rc.1, < 4.3.8
Patches
Vulnerability mechanics
References
78- github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgwnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-wf6x-7x77-mvgwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-29063ghsaADVISORY
- github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945ghsaWEB
- github.com/immutable-js/immutable-js/commit/6e2cf1cfe6137e72dfa48fc2cfa8f4d399d113f9ghsaWEB
- github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cbghsaWEB
- github.com/immutable-js/immutable-js/issues/2178ghsaWEB
- github.com/immutable-js/immutable-js/releases/tag/v3.8.3nvdRelease NotesWEB
- github.com/immutable-js/immutable-js/releases/tag/v4.3.8nvdRelease NotesWEB
- github.com/immutable-js/immutable-js/releases/tag/v5.1.5nvdRelease NotesWEB
- access.redhat.com/errata/RHSA-2026:11070nvd
- access.redhat.com/errata/RHSA-2026:11217nvd
- access.redhat.com/errata/RHSA-2026:11414nvd
- access.redhat.com/errata/RHSA-2026:11858nvd
- access.redhat.com/errata/RHSA-2026:11916nvd
- access.redhat.com/errata/RHSA-2026:12118nvd
- access.redhat.com/errata/RHSA-2026:13542nvd
- access.redhat.com/errata/RHSA-2026:13548nvd
- access.redhat.com/errata/RHSA-2026:13791nvd
- access.redhat.com/errata/RHSA-2026:13826nvd
- access.redhat.com/errata/RHSA-2026:13829nvd
- access.redhat.com/errata/RHSA-2026:13847nvd
- access.redhat.com/errata/RHSA-2026:13853nvd
- access.redhat.com/errata/RHSA-2026:17469nvd
- access.redhat.com/errata/RHSA-2026:17598nvd
- access.redhat.com/errata/RHSA-2026:19375nvd
- access.redhat.com/errata/RHSA-2026:19409nvd
- access.redhat.com/errata/RHSA-2026:19410nvd
- access.redhat.com/errata/RHSA-2026:19712nvd
- access.redhat.com/errata/RHSA-2026:20034nvd
- access.redhat.com/errata/RHSA-2026:20041nvd
- access.redhat.com/errata/RHSA-2026:20042nvd
- access.redhat.com/errata/RHSA-2026:20088nvd
- access.redhat.com/errata/RHSA-2026:21657nvd
- access.redhat.com/errata/RHSA-2026:21658nvd
- access.redhat.com/errata/RHSA-2026:21703nvd
- access.redhat.com/errata/RHSA-2026:21931nvd
- access.redhat.com/errata/RHSA-2026:22465nvd
- access.redhat.com/errata/RHSA-2026:23246nvd
- access.redhat.com/errata/RHSA-2026:24473nvd
- access.redhat.com/errata/RHSA-2026:24977nvd
- access.redhat.com/errata/RHSA-2026:26225nvd
- access.redhat.com/errata/RHSA-2026:26232nvd
- access.redhat.com/errata/RHSA-2026:27063nvd
- access.redhat.com/errata/RHSA-2026:28893nvd
- access.redhat.com/errata/RHSA-2026:28964nvd
- access.redhat.com/errata/RHSA-2026:29857nvd
- access.redhat.com/errata/RHSA-2026:29864nvd
- access.redhat.com/errata/RHSA-2026:34049nvd
- access.redhat.com/errata/RHSA-2026:34099nvd
- access.redhat.com/errata/RHSA-2026:34100nvd
- access.redhat.com/errata/RHSA-2026:34342nvd
- access.redhat.com/errata/RHSA-2026:36621nvd
- access.redhat.com/errata/RHSA-2026:36651nvd
- access.redhat.com/errata/RHSA-2026:36882nvd
- access.redhat.com/errata/RHSA-2026:40022nvd
- access.redhat.com/errata/RHSA-2026:40118nvd
- access.redhat.com/errata/RHSA-2026:40945nvd
- access.redhat.com/errata/RHSA-2026:40984nvd
- access.redhat.com/errata/RHSA-2026:41928nvd
- access.redhat.com/errata/RHSA-2026:41941nvd
- access.redhat.com/errata/RHSA-2026:41944nvd
- access.redhat.com/errata/RHSA-2026:6428nvd
- access.redhat.com/errata/RHSA-2026:6568nvd
- access.redhat.com/errata/RHSA-2026:6720nvd
- access.redhat.com/errata/RHSA-2026:6926nvd
- access.redhat.com/errata/RHSA-2026:7329nvd
- access.redhat.com/errata/RHSA-2026:8218nvd
- access.redhat.com/errata/RHSA-2026:8483nvd
- access.redhat.com/errata/RHSA-2026:8484nvd
- access.redhat.com/errata/RHSA-2026:8490nvd
- access.redhat.com/errata/RHSA-2026:8491nvd
- access.redhat.com/errata/RHSA-2026:8493nvd
- access.redhat.com/errata/RHSA-2026:9742nvd
- access.redhat.com/errata/RHSA-2026:9848nvd
- access.redhat.com/security/cve/CVE-2026-29063nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.jsonnvd
News mentions
0No linked articles in our index yet.