Unrated severityOSV Advisory· Published Jul 9, 2026
Debian node-immutable: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 …
CVE-2026-59879
Description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 30 to 2 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
Affected products
3v5.1.7, v5.1.6, v4.3.8, …+ 1 more
- (no CPE)range: v5.1.7, v5.1.6, v4.3.8, …
- (no CPE)range: <4.3.9, <5.1.8
- Range: <4.3.9, <5.1.8
Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.