[Pkg-javascript-devel] Bug#1141821: node-immutable: CVE-2026-59879 CVE-2026-59880

[Salvatore Bonaccorso]

Source: node-immutable
Version: 4.3.8-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for node-immutable.

CVE-2026-59879[0]:
| Immutable.js provides many Persistent Immutable data structures.
| Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn,
| List#updateIn, and the functional set, setIn, and updateIn mishandle
| an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in
| src/List.js, causing an empty List to enter an uncatchable infinite
| loop, a populated List to allocate without bound until process
| abort, or setSize to silently wrap large values. This issue is fixed
| in versions 4.3.9 and 5.1.8.


CVE-2026-59880[1]:
| Immutable.js provides many Persistent Immutable data structures.
| Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys
| that share the same 32-bit hash in a HashCollisionNode collision
| bucket that is scanned linearly, allowing an attacker who controls
| keys inserted into a Map, such as through Immutable.Map(obj),
| Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to
| craft many colliding keys and degrade insertion and lookup to
| consume disproportionate CPU. This issue is fixed in versions 4.3.9
| and 5.1.8.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-59879
    https://www.cve.org/CVERecord?id=CVE-2026-59879
[1] https://security-tracker.debian.org/tracker/CVE-2026-59880
    https://www.cve.org/CVERecord?id=CVE-2026-59880

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore