{"id":"CVE-2026-59879","aliases":["GHSA-v56q-mh7h-f735"],"url":"https://o3.security/vulnerability/CVE-2026-59879","summary":"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS","details":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.","published":"2026-07-08T15:47:24.885Z","modified":"2026-08-12T03:51:42.821489754Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"immutable","fixedVersion":"4.3.9"},{"ecosystem":"npm","name":"immutable","fixedVersion":"5.1.8"}],"fix":{"url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","label":"immutable-js/immutable-js@a1a1ee4"},"references":[{"type":"WEB","url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9"},{"type":"WEB","url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59879.json"},{"type":"ADVISORY","url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59879"},{"type":"FIX","url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84"},{"type":"FIX","url":"https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.821489754Z"}}