Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Published: 2026-03-06
Score: 8.7 High
EPSS: 1.0% Low
KEV: No
Impact: Prototype pollution that permits unauthorized modification of Object.prototype
Action: Patch immediately
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype Pollution
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:11070 cve-icon
https://access.redhat.com/errata/RHSA-2026:11217 cve-icon
https://access.redhat.com/errata/RHSA-2026:11414 cve-icon
https://access.redhat.com/errata/RHSA-2026:11858 cve-icon
https://access.redhat.com/errata/RHSA-2026:11916 cve-icon
https://access.redhat.com/errata/RHSA-2026:12118 cve-icon
https://access.redhat.com/errata/RHSA-2026:13542 cve-icon
https://access.redhat.com/errata/RHSA-2026:13548 cve-icon
https://access.redhat.com/errata/RHSA-2026:13791 cve-icon
https://access.redhat.com/errata/RHSA-2026:13826 cve-icon
https://access.redhat.com/errata/RHSA-2026:13829 cve-icon
https://access.redhat.com/errata/RHSA-2026:13847 cve-icon
https://access.redhat.com/errata/RHSA-2026:13853 cve-icon
https://access.redhat.com/errata/RHSA-2026:17469 cve-icon
https://access.redhat.com/errata/RHSA-2026:17598 cve-icon
https://access.redhat.com/errata/RHSA-2026:19375 cve-icon
https://access.redhat.com/errata/RHSA-2026:19409 cve-icon
https://access.redhat.com/errata/RHSA-2026:19410 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:20034 cve-icon
https://access.redhat.com/errata/RHSA-2026:20041 cve-icon
https://access.redhat.com/errata/RHSA-2026:20042 cve-icon
https://access.redhat.com/errata/RHSA-2026:20088 cve-icon
https://access.redhat.com/errata/RHSA-2026:21657 cve-icon
https://access.redhat.com/errata/RHSA-2026:21658 cve-icon
https://access.redhat.com/errata/RHSA-2026:21703 cve-icon
https://access.redhat.com/errata/RHSA-2026:21931 cve-icon
https://access.redhat.com/errata/RHSA-2026:22465 cve-icon
https://access.redhat.com/errata/RHSA-2026:23246 cve-icon
https://access.redhat.com/errata/RHSA-2026:24473 cve-icon
https://access.redhat.com/errata/RHSA-2026:24977 cve-icon
https://access.redhat.com/errata/RHSA-2026:26225 cve-icon
https://access.redhat.com/errata/RHSA-2026:26232 cve-icon
https://access.redhat.com/errata/RHSA-2026:27063 cve-icon
https://access.redhat.com/errata/RHSA-2026:28893 cve-icon
https://access.redhat.com/errata/RHSA-2026:28964 cve-icon
https://access.redhat.com/errata/RHSA-2026:29857 cve-icon
https://access.redhat.com/errata/RHSA-2026:29864 cve-icon
https://access.redhat.com/errata/RHSA-2026:34049 cve-icon
https://access.redhat.com/errata/RHSA-2026:34099 cve-icon
https://access.redhat.com/errata/RHSA-2026:34100 cve-icon
https://access.redhat.com/errata/RHSA-2026:34342 cve-icon
https://access.redhat.com/errata/RHSA-2026:36621 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36882 cve-icon
https://access.redhat.com/errata/RHSA-2026:40022 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40984 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41941 cve-icon
https://access.redhat.com/errata/RHSA-2026:41944 cve-icon
https://access.redhat.com/errata/RHSA-2026:6428 cve-icon
https://access.redhat.com/errata/RHSA-2026:6568 cve-icon
https://access.redhat.com/errata/RHSA-2026:6720 cve-icon
https://access.redhat.com/errata/RHSA-2026:6926 cve-icon
https://access.redhat.com/errata/RHSA-2026:7329 cve-icon
https://access.redhat.com/errata/RHSA-2026:8218 cve-icon
https://access.redhat.com/errata/RHSA-2026:8483 cve-icon
https://access.redhat.com/errata/RHSA-2026:8484 cve-icon
https://access.redhat.com/errata/RHSA-2026:8490 cve-icon
https://access.redhat.com/errata/RHSA-2026:8491 cve-icon
https://access.redhat.com/errata/RHSA-2026:8493 cve-icon
https://access.redhat.com/errata/RHSA-2026:9742 cve-icon
https://access.redhat.com/errata/RHSA-2026:9848 cve-icon
https://access.redhat.com/security/cve/CVE-2026-29063 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2445291 cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 cve-icon cve-icon cve-icon
https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-29063 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-29063 cve-icon
History

Fri, 30 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat 3scale Api Management Platform
Redhat advanced Cluster Management For Kubernetes
Redhat advanced Cluster Security
Redhat ansible Automation Platform
Redhat build Of Apicurio Registry
Redhat connectivity Link
Redhat developer Hub
Redhat discovery
Redhat edge Manager
Redhat enterprise Linux
Redhat logging Subsystem For Red Hat Openshift
Redhat migration Toolkit
Redhat migration Toolkit For Virtualization
Redhat multicluster Engine For Kubernetes
Redhat network Observability Operator
Redhat openshift Cluster Observability Operator
Redhat openshift Container Platform
Redhat openshift Data Foundation
Redhat openshift Gitops
Redhat openshift Lightspeed
Redhat openshift Pipelines
Redhat openshift Service Mesh
Redhat openshift Virtualization
Redhat quay
Redhat satellite
Redhat self-service Automation Portal
CPEs cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernetes:*:*
cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:build_of_apicurio_registry:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:connectivity_link:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:developer_hub:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:discovery:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:edge_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit:1.8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.10.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_virtualization:2.9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:network_observability_operator:1.11.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:network_observability_operator:1.12.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_cluster_observability_operator:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_data_foundation:4.17:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_lightspeed:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_pipelines:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:2.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:3.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:quay:3.18.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*
cpe:2.3:a:redhat:self-service_automation_portal:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Redhat
Redhat 3scale Api Management Platform
Redhat advanced Cluster Management For Kubernetes
Redhat advanced Cluster Security
Redhat ansible Automation Platform
Redhat build Of Apicurio Registry
Redhat connectivity Link
Redhat developer Hub
Redhat discovery
Redhat edge Manager
Redhat enterprise Linux
Redhat logging Subsystem For Red Hat Openshift
Redhat migration Toolkit
Redhat migration Toolkit For Virtualization
Redhat multicluster Engine For Kubernetes
Redhat network Observability Operator
Redhat openshift Cluster Observability Operator
Redhat openshift Container Platform
Redhat openshift Data Foundation
Redhat openshift Gitops
Redhat openshift Lightspeed
Redhat openshift Pipelines
Redhat openshift Service Mesh
Redhat openshift Virtualization
Redhat quay
Redhat satellite
Redhat self-service Automation Portal

Fri, 17 Apr 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Immutable-js immutable
CPEs cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
Vendors & Products Immutable-js immutable
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 26 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-915
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Mon, 09 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Immutable-js
Immutable-js immutable-js
Vendors & Products Immutable-js
Immutable-js immutable-js

Fri, 06 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 18:45:00 +0000

Type Values Removed Values Added
Description Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Title Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Immutable-js Immutable Immutable-js
Redhat 3scale Api Management Platform Advanced Cluster Management For Kubernetes Advanced Cluster Security Ansible Automation Platform Build Of Apicurio Registry Connectivity Link Developer Hub Discovery Edge Manager Enterprise Linux Logging Subsystem For Red Hat Openshift Migration Toolkit Migration Toolkit For Virtualization Multicluster Engine For Kubernetes Network Observability Operator Openshift Cluster Observability Operator Openshift Container Platform Openshift Data Foundation Openshift Gitops Openshift Lightspeed Openshift Pipelines Openshift Service Mesh Openshift Virtualization Quay Satellite Self-service Automation Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T12:05:01.255Z

Reserved: 2026-03-03T20:51:43.481Z

Link: CVE-2026-29063

cve-icon Vulnrichment

Updated: 2026-09-10T12:05:01.255Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-06T19:16:21.557

Modified: 2026-10-30T13:16:36.640

Link: CVE-2026-29063

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-06T18:25:22Z

Links: CVE-2026-29063 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T11:30:15Z

Weaknesses