Skip to content
Fencer Vulns
high 7.5

CVE-2026-59879 json

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

published 2026-07-08 4 mo ago modified 2026-09-16 53 d ago also GHSA-v56q-mh7h-f735 , EUVD-2026-42318

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

Patch / fix

  • npm immutable 3.8.4, 4.3.9, 5.1.8
  • immutable-js immutable 4.3.9, 5.1.8
  • node-immutable Debian 14 4.3.9-1

debian advisories DEBIAN-CVE-2026-59879

  • foreman satellite utils 6.19, satellite capsule 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-cli satellite utils 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-ec2 satellite 6.19 3.18.0.14-1.el9sat
  • foreman-pcp satellite capsule 6.19, satellite 6.19 3.18.0.14-1.el9sat
  • foreman-redis satellite 6.19 3.18.0.14-1.el9sat
  • foreman-vmware satellite 6.19 3.18.0.14-1.el9sat
  • foreman-libvirt satellite 6.19 3.18.0.14-1.el9sat
  • foreman-service satellite 6.19 3.18.0.14-1.el9sat

red hat advisories RHSA-2026:74503

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59879 updated cvss 5.3

immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations

  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-view-plugin-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-compat-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8
    affected: workaround, no fix available
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-tech-preview/automation-dashboard-rhel9
    affected: workaround, no fix available
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-ocp-rhel9
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 10 subscription-manager-cockpit
    affected: workaround, no fix planned “Will not fix”
show 26 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9 Red Hat OpenShift Container Platform 5 openshift4/ose-console-rhel9, openshift5/ose-console-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/console-plugin-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Satellite 6 nodejs-connected-react-router
    affected: workaround, no fix available
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-19
    fixed: vendor fix RHSA-2026:95360
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/console-mce-rhel9 1790117683
    fixed: vendor fix RHSA-2026:72850
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/console-mce-rhel9 1790121310
    fixed: vendor fix RHSA-2026:72854
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/console-mce-rhel9 1789583887
    fixed: vendor fix RHSA-2026:72851
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1788563615
    fixed: vendor fix RHSA-2026:67539
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1790254963
    fixed: vendor fix RHSA-2026:72712
  • Red Hat Container Native Virtualization 4.17 container-native-virtualization/kubevirt-console-plugin-rhel9 1793395171
    fixed: vendor fix RHSA-2026:93951
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1789677459
    fixed: vendor fix RHSA-2026:69289
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1791853281
    fixed: vendor fix RHSA-2026:85846
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift Container Platform 4.19 openshift4/nmstate-console-plugin-rhel9 1790609954
    fixed: vendor fix RHSA-2026:74435
  • Red Hat OpenShift Container Platform 4.20 openshift4/nmstate-console-plugin-rhel9 1791962249
    fixed: vendor fix RHSA-2026:83503
  • Red Hat OpenShift Container Platform 4.21 openshift4/nmstate-console-plugin-rhel9 1790778086
    fixed: vendor fix RHSA-2026:74384
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1793125678, odf4/odf-cli-rhel9 1793126086, odf4/mcg-core-rhel9 1793125866, odf4/odf-console-rhel9 1793126829, odf4/mcg-rhel9-operator 1793125881, odf4/ocs-rhel9-operator 1793126016, +14 more
    fixed: vendor fix RHSA-2026:92650
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1789024827, openshift-service-mesh/kiali-ossmc-rhel9 1789023352
    fixed: vendor fix RHSA-2026:68687
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1789084585, openshift-service-mesh/kiali-ossmc-rhel9 1789023231
    fixed: vendor fix RHSA-2026:68689
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1789022173, openshift-service-mesh/kiali-ossmc-rhel9 1789021821
    fixed: vendor fix RHSA-2026:68691
  • Red Hat Quay 3.9 quay/quay-rhel8 1790808443
    fixed: vendor fix RHSA-2026:77656
  • Red Hat Quay 3.10 quay/quay-rhel8 1791462428
    fixed: vendor fix RHSA-2026:79366
  • Red Hat Quay 3.12 quay/quay-rhel8 1791314514
    fixed: vendor fix RHSA-2026:79546
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Satellite 6.18 satellite/iop-vulnerability-frontend-rhel9 1789660969, satellite/iop-host-inventory-frontend-rhel9 1789613107
    fixed: vendor fix RHSA-2026:68756
  • Red Hat Satellite 6.19 for RHEL 9 foreman 3.18.0.14-1.el9sat, foreman-cli 3.18.0.14-1.el9sat, foreman-ec2 3.18.0.14-1.el9sat, foreman-pcp 3.18.0.14-1.el9sat, foreman-redis 3.18.0.14-1.el9sat, foreman-vmware 3.18.0.14-1.el9sat, +7 more
    fixed: vendor fix RHSA-2026:74503

26 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm immutable
>=4.0.0-rc.1, <4.3.9
>=5.0.0-beta.1, <5.1.8
<3.8.4
4.3.9
5.1.8
3.8.4

Affected products

  • immutable-js immutable-js

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-1284 Improper Validation of Specified Quantity in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.