8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29063

CVE-2026-29063: Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29063

CVE-2026-29063:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
immutable	npm	>= 5.0.0, < 5.1.5	5.1.5
immutable	npm	>= 4.0.0-rc.1, < 4.3.8	4.3.8
immutable	npm	< 3.8.3	3.8.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of prototype pollution in JavaScript, affecting the immutable library. The core issue lies in several API functions that create or modify plain JavaScript objects from immutable data structures or other objects. These functions did not properly sanitize or block keys named __proto__ or constructor. When a user-controlled payload (e.g., a JSON object from an HTTP request) containing a __proto__ key is processed by these functions, the library would inadvertently modify the Object.prototype. This allows an attacker to inject properties into the prototype of all objects in the application, potentially leading to security bypasses, denial of service, or remote code execution, depending on how the application's code uses objects.

The analysis of the patches shows that the fix consistently involves adding a check, isProtoKey(key), before assigning a property to a new or copied object. This check blocks keys that are either __proto__ or constructor. The affected functions identified are merge, mergeDeep, mergeDeepWith (all using the vulnerable mergeWithSources logic), Map.toJS, Map.toObject, and the set function. The utility function shallowCopy was also patched as it was a source of the pollution in other functions.

Vulnerable functions

mergeWithSources

src/functional/merge.js

The `mergeWithSources` function, which is used by `merge`, `mergeDeep`, and `mergeDeepWith`, did not check for keys like `__proto__` or `constructor`. An attacker could provide a malicious object (e.g., from a JSON payload) with a `__proto__` property, which would then be merged into the target object, polluting its prototype. The patch adds a call to `isProtoKey` to skip such keys.

toObject

src/methods/toObject.js

The `toObject` method iterates over the entries of an immutable `Map` and assigns them as properties to a new plain JavaScript object. Before the patch, if the `Map` contained a key named `__proto__`, the method would assign a value to the `__proto__` property of the new object, leading to prototype pollution. The patch introduces a check to ignore `__proto__` and `constructor` keys during the conversion.

toJS

src/toJS.ts

The `toJS` function recursively converts an immutable collection into a plain JavaScript object or array. When converting a `Keyed` collection (like a `Map`), it would iterate over keys and assign them to a new object. Similar to `toObject`, it was vulnerable to prototype pollution if a key was `__proto__`. The patch adds the `isProtoKey` check to prevent this.

set

src/functional/set.ts

The `set` function is used to create a new collection with an updated value for a given key. The vulnerability existed because it was possible to set a value for a key like `__proto__` on a plain JavaScript object, which would return a new object with a polluted prototype. The patch prevents this by explicitly checking for `__proto__` or `constructor` keys and returning the original collection unmodified.

shallowCopy

src/utils/shallowCopy.ts

The `shallowCopy` utility function was vulnerable as it iterated over all properties of an object, including a potential `__proto__` own property (e.g., from `JSON.parse`), and copied it to the new object. This function is used internally by other functions like `set`, contributing to the spread of the vulnerability. The patch adds a check to skip `__proto__` and `constructor` keys during the copy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.