CVE-2026-59879: Immutable.js DOS Vulnerability

CVE-2026-59879 Overview

CVE-2026-59879 is an integer overflow vulnerability [CWE-190] in Immutable.js, a widely used JavaScript library that provides persistent immutable data structures. The flaw affects List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn operations. When an index or size falls within the range 2 ** 30 to 2 ** 31, the setListBounds function in src/List.js mishandles the value. This causes an empty List to enter an uncatchable infinite loop, a populated List to allocate memory without bound until the process aborts, or setSize to silently wrap large values. The issue is fixed in versions 4.3.9 and 5.1.8.

Critical Impact
Attackers who control List indices or sizes can trigger denial-of-service conditions through uncatchable infinite loops, unbounded memory allocation, or silent data corruption.

Affected Products

Immutable.js versions prior to 4.3.9 (4.x branch)
Immutable.js versions prior to 5.1.8 (5.x branch)
Applications and Node.js services that pass user-controlled input to List size or index operations

Discovery Timeline

2026-07-08 - CVE-2026-59879 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59879

Vulnerability Analysis

Immutable.js stores List data in a trie structure that assumes indices remain within a safe signed 32-bit range. The setListBounds function coerces requested origin and capacity values to int32 without validating that the requested range fits within MAX_LIST_SIZE (2 ** 30). When a caller supplies an index or size between 2 ** 30 and 2 ** 31, the coercion produces values that break internal invariants. An empty List can enter an infinite loop that JavaScript cannot interrupt, exhausting the event loop. A populated List attempts to grow its backing trie unbounded, forcing the Node.js process to abort on out-of-memory. setSize silently wraps the requested value, yielding a List whose logical size no longer matches caller expectations.

Root Cause

The root cause is missing bounds validation before int32 coercion inside setListBounds. The function did not check whether the requested origin or capacity exceeded the trie's safe range prior to arithmetic operations. This is a classic integer overflow pattern where an internal invariant (capacity - origin <= MAX_LIST_SIZE) is assumed but never enforced against caller-supplied values.

Attack Vector

Exploitation is network-reachable when an application forwards untrusted numeric input into List operations. Any HTTP endpoint, WebSocket handler, or message consumer that constructs or resizes an Immutable.js List using values derived from a request body, query parameter, or deserialized payload can be targeted. The attacker sends a payload where a size or index field falls in the vulnerable range. No authentication or user interaction is required when the vulnerable code path is reachable.

javascript

// Security patch adding validateListBoundsRequest in src/List.js
/**
 * Validates requested bounds before int32 coercion in setListBounds().
 * Throws when origin/capacity would exceed the trie's safe range.
 */
function validateListBoundsRequest(list, begin, end) {
  const requestedOrigin = list._origin + (begin === undefined ? 0 : begin);
  const requestedCapacity =
    end === undefined
      ? list._capacity
      : end < 0
        ? list._capacity + end
        : list._origin + end;

  // Keep origin/capacity within the trie's safe signed 32-bit range.
  if (
    (Number.isFinite(requestedCapacity) && requestedCapacity > MAX_LIST_SIZE) ||
    (Number.isFinite(requestedOrigin) && requestedOrigin < -MAX_LIST_SIZE) ||
    (Number.isFinite(requestedCapacity) &&
      Number.isFinite(requestedOrigin) &&
      requestedCapacity - requestedOrigin > MAX_LIST_SIZE)
  ) {
    throw new RangeError(
      'Invalid List size: a List cannot hold more than ' +
        MAX_LIST_SIZE +
        ' (2 ** 30) values.'
    );
  }
// Source: [GitHub Commit a1a1ee4](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)

Detection Methods for CVE-2026-59879

Indicators of Compromise

Node.js processes terminating with out-of-memory (FATAL ERROR: Reached heap limit Allocation failed) shortly after handling a specific request.
Event loop stalls or unresponsive workers correlated with requests containing large numeric fields near 1073741824 (2 ** 30).
Repeated worker restarts or container restarts on services that deserialize user input into Immutable.js Lists.

Detection Strategies

Inventory dependencies with npm ls immutable or yarn why immutable and flag any version below 4.3.9 or 5.1.8, including transitive occurrences.
Add SCA (Software Composition Analysis) rules in CI that fail builds referencing vulnerable Immutable.js ranges via the GitHub Security Advisory GHSA-v56q-mh7h-f735.
Review code paths that pass request-derived values to List#set, List#setSize, List#setIn, List#updateIn, set, setIn, or updateIn.

Monitoring Recommendations

Alert on abnormal Node.js heap growth and process aborts on services known to use Immutable.js.
Log requests immediately preceding a worker crash and retain request bodies for post-mortem correlation.
Monitor request payloads for numeric fields exceeding 2 ** 30 when those fields feed collection sizing or indexing.

How to Mitigate CVE-2026-59879

Immediate Actions Required

Upgrade Immutable.js to 4.3.9 on the 4.x branch or 5.1.8 on the 5.x branch as documented in the GitHub Security Advisory GHSA-v56q-mh7h-f735.
Audit application code for List operations that accept untrusted indices or sizes and add server-side validation.
Rebuild and redeploy any container images or serverless bundles that pin a vulnerable Immutable.js version.

Patch Information

The maintainers released Immutable.js v4.3.9 and Immutable.js v5.1.8. The fix introduces validateListBoundsRequest in src/List.js, which throws a RangeError when the requested origin or capacity would exceed MAX_LIST_SIZE. See GitHub Commit a1a1ee4 and GitHub Commit f0bc997 for the code changes.

Workarounds

Reject numeric inputs greater than or equal to 2 ** 30 before passing them to any Immutable.js List operation.
Wrap List size and index operations in explicit range checks that throw before invoking setSize, set, setIn, or updateIn.
Apply upstream input validation at API gateways or schema validators such as Ajv or Zod to constrain integer bounds.

bash

# Upgrade Immutable.js to a patched release
npm install immutable@^5.1.8
# or, for the 4.x line
npm install immutable@^4.3.9

# Verify no vulnerable versions remain in the dependency tree
npm ls immutable