# CVE-2026-29063: Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

> CVE-2026-29063: Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable. CVSS 8.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-29063
Last updated: 2026-09-10T13:18:02Z

- Published: 2026-03-06 18:25 UTC · Updated: 2026-09-10 13:18 UTC · Assigner: GitHub\_M
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: 1.0%, 63th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-1321

## Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

## Affected vendors and products

- immutable-js: immutable-js
- Red Hat: Cluster Observability Operator 1.5.0
- Red Hat: Logging Subsystem for Red Hat OpenShift
- Red Hat: Node HealthCheck Operator
- Red Hat: OpenShift Lightspeed
- Red Hat: OpenShift Pipelines
- Red Hat: OpenShift Service Mesh 3
- Red Hat: Red Hat 3scale API Management Platform 2
- Red Hat: Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat: Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat: Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat: Red Hat Advanced Cluster Security 4.8
- Red Hat: Red Hat Advanced Cluster Security 4.9
- Red Hat: Red Hat Advanced Cluster Security for Kubernetes 4.10
- Red Hat: Red Hat Ansible Automation Platform 2
- Red Hat: Red Hat build of Apicurio Registry 2
- Red Hat: Red Hat Connectivity Link 1
- Red Hat: Red Hat Discovery 2
- Red Hat: Red Hat Edge Manager 1.0
- Red Hat: Red Hat Edge Manager 1.1
- Red Hat: Red Hat Enterprise Linux 10
- Red Hat: Red Hat Enterprise Linux 8
- Red Hat: Red Hat Enterprise Linux 9
- Red Hat: Red Hat OpenShift AI (RHOAI)
- Red Hat: Red Hat OpenShift Container Platform 4
- Red Hat: Red Hat OpenShift GitOps
- Red Hat: Red Hat OpenShift Virtualization 4
- Red Hat: Red Hat Satellite 6
- Red Hat: Self-service automation portal 2

## Tracked companies

- [Confluence](https://rewindex.com/company/confluence.md)
- [Jira](https://rewindex.com/company/jira.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-29063)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-29063)
- [https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3](https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3)
- [https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8)
- [https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5)
- [https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-29063 · Markdown: https://rewindex.com/cve/CVE-2026-29063.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-29063 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:05.207Z