CVE-2026-29063

8.7 highEPSS 1.0%

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-30)
CWEs: CWE-1321, CWE-915
Published: 2026-03-06
Modified: 2026-10-30
Record from: the NVD, synced 2026-10-30

Affected

immutable-js:immutable
redhat:3scale_api_management_platform
redhat:advanced_cluster_management_for_kubernetes
redhat:advanced_cluster_security
redhat:ansible_automation_platform
redhat:build_of_apicurio_registry
redhat:connectivity_link
redhat:developer_hub
redhat:discovery
redhat:edge_manager
redhat:enterprise_linux
redhat:logging_subsystem_for_red_hat_openshift
redhat:migration_toolkit
redhat:migration_toolkit_for_virtualization
redhat:multicluster_engine_for_kubernetes
redhat:network_observability_operator
redhat:openshift_cluster_observability_operator
redhat:openshift_container_platform
redhat:openshift_data_foundation
redhat:openshift_gitops
redhat:openshift_lightspeed
redhat:openshift_pipelines
redhat:openshift_service_mesh
redhat:openshift_virtualization
redhat:quay
redhat:satellite
redhat:self-service_automation_portal

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wf6x-7x77-mvgw	npm	immutable	>=4.0.0-rc.1 <4.3.8	4.3.8
GHSA-wf6x-7x77-mvgw	npm	immutable	>=5.0.0 <5.1.5	5.1.5
GHSA-wf6x-7x77-mvgw	npm	immutable	<3.8.3	3.8.3

References

Check your stack JSON