CVE-2026-29063: Immutable Package Vulnerable to Prototype Pollution
Summary
CVE-2026-29063: Immutable is vulnerable to Prototype Pollution. Affects immutable across 2 version ranges.
< 4.3.8
>= 5.0.0, < 5.1.5
Fixed in 4.3.8 or 5.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Immutable package is a popular library in the JavaScript ecosystem, primarily used for creating immutable data structures. It provides a range of functionalities, including deep merging of objects and conversion of Maps to JavaScript objects. However, it has been found to be vulnerable to prototype pollution, which can lead to severe security issues.
Vulnerability Detail
The vulnerability arises from the use of certain APIs within the Immutable package, specifically mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(). These functions allow an attacker to manipulate the prototype of objects, potentially leading to unauthorized access or privilege escalation. This can occur when user input is merged into existing objects without proper validation, allowing malicious payloads to inject properties into the prototype chain.
How To Fix
Latest published version: 5.1.9 as of 22 Oct 2026
npm install immutable@5.1.9Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.84.3.8npm install immutable@4.3.8 -
>= 5.0.0, < 5.1.55.1.5npm install immutable@5.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement the following workarounds:
- Validate user input to prevent malicious data from being processed.
- Use the Node.js flag --disable-proto to disable prototype pollution.
- Lock down built-in objects to prevent modification.
- Avoid lookups on the prototype chain.
- Create JavaScript objects with a null prototype to mitigate risks.
Conclusion
The Immutable package has a significant vulnerability related to prototype pollution, which can lead to serious security risks. Users are strongly advised to upgrade to the latest patched versions or implement workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for immutable →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unauthorized access or privilege escalation.
Versions 3.x, 4.x (prior to 4.3.7), and 5.x (prior to 5.1.5) of the Immutable package are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check your application using the Vulert playground without signing up.
If immediate upgrading is not possible, implement the suggested workarounds to mitigate the risk of prototype pollution.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for immutable.
