Immutable-js Immutable — known CVE vulnerabilities

Every CVE whose affected-product data names Immutable-js Immutable, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2026-29063 — CVSS 9.8 (critical): Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible…
• CVE-2026-59879 — CVSS 7.5 (high): Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn…
• CVE-2026-59880 — CVSS 7.5 (high): Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that…