Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Description

List#set, List#setSize, List#setIn, List#updateIn (and the functional set / setIn / updateIn) mishandle an index or size in the range [2 ** 30, 2 ** 31):

• On an empty List the operation enters an uncatchable infinite loop (a tight CPU spin; a surrounding try/catch never regains control).

Recommendation

Update the immutable package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0-beta.1, < 5.1.8

  < 4.3.9**

• Patched version(s): **5.1.8

  4.3.9**

References

• GHSA-v56q-mh7h-f735
• CVE-2026-59879
• CWE-1284
• CWE-190
• CWE-400
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
• SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
• LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body - CVE-2026-44645
• jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

immutable