Description
List#set, List#setSize, List#setIn, List#updateIn (and the functional set / setIn / updateIn) mishandle an index or size in the range [2 ** 30, 2 ** 31):
- On an empty
Listthe operation enters an uncatchable infinite loop (a tight CPU spin; a surroundingtry/catchnever regains control).
Recommendation
Update the immutable package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0-beta.1, < 5.1.8 < 4.3.9** Patched version(s): **5.1.8 4.3.9**
References
Could your website be exposed too?
SmartScanner can check your website for Immutable.js `List` 32-bit trie overflow → unrecoverable DoS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
- SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header - CVE-2026-66062
- LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body - CVE-2026-44645
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
You might also like:
See something that needs correcting? Let us knowUpdated July 21, 2026