Cyber Posture

CVE-2026-29063

CriticalPublic PoC

Published: 06 March 2026

Published
06 March 2026
Modified
17 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 42.4th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely patching of the vulnerable Immutable.js library to fixed versions 3.8.3, 4.3.7, or 5.1.5, eliminating the prototype pollution flaw.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning that would identify the presence of vulnerable Immutable.js versions affected by CVE-2026-29063.

SI-10 Information Input Validation partial match
prevent

Enforces input validation and sanitization to block malicious payloads targeting the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

Security SummaryAI

CVE-2026-29063 is a prototype pollution vulnerability (CWE-1321) in the Immutable.js JavaScript library, which provides persistent immutable data structures. The flaw affects versions prior to 3.8.3, 4.3.7, and 5.1.5, where attackers can exploit it through the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.

Remote attackers require no privileges or user interaction to exploit this over the network with low complexity. Successful exploitation enables prototype pollution, allowing modification of the Object prototype and potentially leading to arbitrary code execution, denial of service, or other impacts depending on how the library is used in the application.

The issue has been patched in Immutable.js versions 3.8.3, 4.3.7, and 5.1.5, as detailed in the project's GitHub security advisory (GHSA-wf6x-7x77-mvgw) and corresponding release notes. Security practitioners should prioritize upgrading affected applications to these fixed versions to mitigate the vulnerability.

Details

CWE(s)
CWE-1321

Affected Products

immutable-js
immutable
3.0.0 — 3.8.3 · 4.0.0 — 4.3.7 · 5.0.0 — 5.1.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Prototype pollution vulnerability in public-facing JavaScript library enables remote unauthenticated exploitation of web applications, directly mapping to Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References