Immutable is vulnerable to Prototype Pollution

Description

A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

Recommendation

Update the immutable package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.8.3

  >= 4.0.0-rc.1, < 4.3.8

  >= 5.0.0, < 5.1.5**

• Patched version(s): **3.8.3

  4.3.8

  5.1.5**

References

• GHSA-wf6x-7x77-mvgw
• CVE-2026-29063
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to schema poisoning via prototype pollution in deep copy - CVE-2026-32878
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
• Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization - CVE-2026-6594

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

immutable