Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-29063

critical

Immutable.js provides many Persistent Immutable data structures.

Vendor / product: Immutable-js — immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-03-06 19:16
Modified: 2026-10-30 13:16
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-11-03 07:34 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

immutable-js / immutable ≥3.0.0 <3.8.3, ≥4.0.0 <4.3.8, ≥5.0.0 <5.1.5
redhat / 3scale_api_management_platform 2.0
redhat / advanced_cluster_management_for_kubernetes ≥2.14 <2.14.3, ≥2.15 <2.15.2, ≥2.16 <2.16.1
redhat / advanced_cluster_security ≥4.8.0 <4.8.11, ≥4.9.0 <4.9.6, ≥4.10.0 <4.10.2
redhat / ansible_automation_platform 2.0
redhat / build_of_apicurio_registry 2.0
redhat / connectivity_link 1.0
redhat / developer_hub ≥1.8.0 <1.8.6, ≥1.9.0 <1.9.4
redhat / discovery 2.0
redhat / edge_manager ≥1.0 <1.0.3, ≥1.1 <1.1.3
redhat / logging_subsystem_for_red_hat_openshift all versions
redhat / migration_toolkit 1.8
redhat / migration_toolkit_for_virtualization 2.9.0, 2.10.0
redhat / multicluster_engine_for_kubernetes ≥2.6 <2.6.10, ≥2.7 <2.7.10, ≥2.8 <2.8.5, ≥2.9 <2.9.3, ≥2.10 <2.10.2, ≥2.11 <2.11.1
redhat / network_observability_operator 1.11.0, 1.12.3
redhat / openshift_cluster_observability_operator 1.5.3
redhat / openshift_container_platform ≥4.12 <4.12.93, ≥4.13 <4.13.69, ≥4.14 <4.14.68, ≥4.15 <4.15.66, ≥4.16 <4.16.63, ≥4.17 <4.17.54
redhat / openshift_data_foundation ≥4.18 <4.18.25, ≥4.19 <4.19.20, ≥4.20 <4.20.15, 4.17
redhat / openshift_gitops all versions
redhat / openshift_lightspeed all versions
redhat / openshift_pipelines ≥1.20 <1.20.5
redhat / openshift_service_mesh 2.6, 3.0, 3.1, 3.2, 3.3
redhat / openshift_virtualization 4
redhat / quay ≥3.9.0 <3.9.20, ≥3.10.0 <3.10.21, ≥3.12.0 <3.12.16, ≥3.15.0 <3.15.4, ≥3.16.0 <3.16.4, ≥3.17.0 <3.17.2
redhat / satellite 6.0, 6.18
redhat / self-service_automation_portal 2.0
redhat / enterprise_linux 8.0, 9.0, 10.0

Weakness classification (CWE)

CWE-1321 CWE-915

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:11070
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:11217
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:11414
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:11858
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:11916
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:12118
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:13542
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:13548
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:13791

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 07:34 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores