Immutable Js: community verdicts

1 notable / known-exploited Immutable Js CVE the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Immutable Js CVE, see NVD ↗.

CVE-2026-29063CRIT 9.8Real · low riskEPSS 1%
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.