CVE-2026-59879: Infinite Loop and Integer Overflow in Immutable.js List Sizing
Vulnerability ID: CVE-2026-59879
CVSS Score: 8.7
Published: 2026-07-21
CVE-2026-59879 describes a critical integer overflow vulnerability in the Immutable.js library when handling indices near 32-bit boundaries. An attacker can leverage this flaw to cause a denial of service via CPU thread lockup or process crashes, as well as data corruption through silent size truncation.
TL;DR
A design flaw in Immutable.js allows integer overflows during list resizing, enabling attackers to cause CPU exhaustion, out-of-memory crashes, or data corruption.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-190, CWE-400, CWE-835, CWE-1284
- Attack Vector: Network
- CVSS v4.0: 8.7 (High)
- EPSS Score: 0.0037 (Percentile: 29.38%)
- Impact: Denial of Service, Data Corruption
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- Applications using Immutable.js versions prior to 4.3.9 (v4 branch) or 5.1.8 (v5 branch)
-
immutable: < 4.3.9 (Fixed in:
4.3.9) -
immutable: >= 5.0.0-beta.1, < 5.1.8 (Fixed in:
5.1.8)
Code Analysis
Commit: a1a1ee4
Fix loop condition in setListBounds and resolve trie scaling issues
Commit: f0bc997
Add safe exponentiation levelCapacity function
Commit: f4c94e2
Refactored validation logic and bounds checks
Exploit Details
- GitHub Advisory: Details on reproducing the infinite loop and crash scenarios.
Mitigation Strategies
- Upgrade Immutable.js to version 4.3.9 or higher (for v4.x) or 5.1.8 or higher (for v5.x).
- Sanitize and validate user-supplied indices and sizes before passing to the library APIs.
- Enforce input validation wrappers that restrict size/index parameters to positive primitive integers below 2^30.
Remediation Steps:
- Identify any transitive or direct dependencies on 'immutable' in the package.json file.
- Update direct dependency 'immutable' to version 4.3.9 or higher (for v4) or 5.1.8 or higher (for v5).
- Implement defensive wrappers to sanitize inputs and convert them to primitive values prior to using API functions like setSize or set.
References
Read the full report for CVE-2026-59879 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)