CRITICAL Published March 6, 2026

CVE-2026-29063

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

CVSS base score
9.8 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-1321, CWE-915
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

immutable-js immutable redhat 3scale api management platform redhat advanced cluster management for kubernetes redhat advanced cluster security redhat ansible automation platform redhat build of apicurio registry redhat connectivity link redhat developer hub redhat discovery redhat edge manager

References

View full NVD advisory →

Related reading

← Back to CVE watch