CVE-2026-59879 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Attackers can cause denial of service via infinite loops or memory exhaustion in Immutable.js List operations using specific large indices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59879?
CVE-2026-59879 is a high-severity denial of service vulnerability in immutable-js, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
Which versions are affected by CVE-2026-59879?
6 open source packages ship an affected version, including immutable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
immutable npm | All versions | 3.8.4 |
immutable npm | All versions | 3.8.4 |
immutable npm | From 4.0.0-rc.1 | 4.3.9 |
immutable npm | From 4.0.0-rc.1 | 4.3.9 |
immutable npm | From 5.0.0-beta.1 | 5.1.8 |
immutable npm | From 5.0.0-beta.1 | 5.1.8 |
Products include Immutable-Js Immutable.
How do I fix CVE-2026-59879?
Upgrade immutable to a fixed version for your release line: 3.8.4, 4.3.9 or 5.1.8.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59879 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59879 exists.
Other vulnerabilities in immutable-js
Sources
Also known as CLEANSTART-2026-BB25914, CLEANSTART-2026-PW50490, CLSA-2026-1784682983, CLSA-2026-1784683091, CLSA-2026-1784769532, CLSA-2026-1788775607 and 14 more.