Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-29063

critical

CVE-2026-29063

immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution

Published Modified CWE 1321, 915
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high).

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Affected packages and fixed versions

SourcePackageFixed in
chainguardarangodb-3.11, arangodb-3.12, argo-workflows-3.6 and 19 more3.11.14.5-r13 and 21 more
debian 11node-immutableno fix listed
debian 12node-immutableno fix listed
debian 13node-immutableno fix listed
debian 14node-immutable4.3.8-1
echonode-immutableno fix listed
echo npm::Echo OSVimmutable3.7.6+echo.1
minimosargo-workflows-3.7, argo-workflows-fips-3.73.7.10-r4 and 1 more
npm::GitHub Security Advisory npmimmutable4.3.8, 5.1.5, 3.8.3
rapidfort alma 10grafana, grafana-selinuxno fix listed
rapidfort alma 9gjs, grafana, grafana-selinuxno fix listed
rapidfort debian 12node-immutable0:4.3.8-1
Show all 72 entries from 22 sources
SourcePackageFixed in
chainguardarangodb-3.113.11.14.5-r13
chainguardarangodb-3.123.12.9.4-r26
chainguardargo-workflows-3.63.6.19-r3
chainguardargo-workflows-3.73.7.10-r4
chainguardargo-workflows-4.04.0.1-r4
chainguardauthentik-2026.22026.2.5-r4
chainguardauthentik-fips-2026.22026.2.4-r11
chainguardgitlab-rails-ce-18.1118.11.13-r0
chainguardgitlab-rails-ce-19.019.0.3-r1
chainguardgitlab-rails-ce-19.119.1.7-r6
chainguardgitlab-rails-ce-19.219.2.5-r2
chainguardgitlab-rails-ce-19.319.3.1-r6
chainguardgitlab-rails-ce-fips-18.118.1.6-r15
chainguardgitlab-rails-ce-fips-18.1018.10.8-r8
chainguardgitlab-rails-ce-fips-18.1118.11.12-r2
chainguardgitlab-rails-ce-fips-18.918.9.8-r8
chainguardgitlab-rails-ce-fips-19.019.0.9-r3
chainguardgitlab-rails-ce-fips-19.119.1.1-r1
chainguardkubeflow-katib0.19.0-r40
chainguardrancher-api-ui1.2.3-r6
chainguardvitess-2222.0.4-r6
chainguardvitess-2323.0.3-r7
debian 11node-immutableno fix listed
debian 12node-immutableno fix listed
debian 13node-immutableno fix listed
debian 14node-immutable4.3.8-1
echonode-immutableno fix listed
echo npm::Echo OSVimmutable3.7.6+echo.1
minimosargo-workflows-3.73.7.10-r4
minimosargo-workflows-fips-3.73.7.10-r5
npm::GitHub Security Advisory npmimmutable4.3.8, 5.1.5, 3.8.3
rapidfort alma 10grafanano fix listed
rapidfort alma 10grafana-selinuxno fix listed
rapidfort alma 9gjsno fix listed
rapidfort alma 9grafanano fix listed
rapidfort alma 9grafana-selinuxno fix listed
rapidfort debian 12node-immutable0:4.3.8-1
rapidfort debian 13node-immutable0:4.3.8-1
rapidfort fedora 43grafana10.2.6-23.fc43
rapidfort fedora 43grafana-selinux10.2.6-23.fc43
rapidfort Oracle Linux 10grafanano fix listed
rapidfort Oracle Linux 10grafana-selinuxno fix listed
rapidfort Oracle Linux 9gjsno fix listed
rapidfort Oracle Linux 9grafanano fix listed
rapidfort Oracle Linux 9grafana-selinuxno fix listed
rapidfort Red Hat 10grafanano fix listed
rapidfort Red Hat 10grafana-selinuxno fix listed
rapidfort Red Hat 9grafanano fix listed
rapidfort Red Hat 9grafana-selinuxno fix listed
rapidfort rocky 10grafanano fix listed
rapidfort rocky 10grafana-selinuxno fix listed
rapidfort rocky 9gjsno fix listed
rapidfort rocky 9grafanano fix listed
rapidfort rocky 9grafana-selinuxno fix listed
Red Hatgjsno fix listed
Red Hatgjs-develno fix listed
Red Hatgrafanano fix listed
Red Hatgrafana-selinuxno fix listed
Red Hatnodejs-connected-react-routerno fix listed
Red Hatopenshift-service-mesh/kiali-ossmc-rhel8no fix listed
Red Hatopenshift-service-mesh/kiali-rhel8no fix listed
Red Hatopenshift4/nmstate-console-plugin-rhel9no fix listed
Red Hatopenshift4/ose-consoleno fix listed
Red Hatopenshift4/ose-console-rhel9no fix listed
Red Hatopenshift4/ose-monitoring-plugin-rhel9no fix listed
Red Hatopenshift4/ose-networking-console-plugin-rhel9no fix listed
Red Hatsatellite/iop-host-inventory-frontend-rhel9no fix listed
Red Hatsatellite/iop-vulnerability-frontend-rhel9no fix listed
wolfiargo-workflows-4.04.0.1-r4
wolfikubeflow-katib0.19.0-r40
wolfirancher-api-ui1.2.3-r6
wolfivitess-2323.0.3-r7

References

All 81 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.