CVE-2026-29063 is a critical (CVSS 9.8) prototype pollution flaw in Immutable.js. The mergeDeep(), mergeDeepWith(), merge(), Map.toJS() and Map.toObject() APIs are affected. Fixed versions are 3.8.3, 4.3.8 and 5.1.5, so upgrade to the one that matches your major version.
What's affected
The GitHub advisory lists the npm package immutable as affected in these ranges: below 3.8.3, from 4.0.0-rc.1 to below 4.3.8, and from 5.0.0 to below 5.1.5. Fixed versions are 3.8.3, 4.3.8 and 5.1.5.
The NVD text names 4.3.7 as a patched version, while the advisory table and the linked release use 4.3.8, so aim for 4.3.8.
Affected APIs listed in the advisory are mergeDeep, mergeDeepWith, merge, Map.toJS(), Map.toObject() and Map.mergeDeep() when the source is converted to a plain object.
How to check if you're exposed
Check which version each project resolves, including transitive uses:
npm ls immutable
With yarn run yarn why immutable, and with pnpm pnpm why immutable. Several copies at different versions can be present at once, so read the whole tree. Paste a lockfile into the free in-browser dependency scan to find every copy at once.
What to do now
- Upgrade to 3.8.3, 4.3.8 or 5.1.5, depending on your major version, and make sure transitive copies are updated too (use overrides or resolutions if a parent package pins an old one).
- Rebuild and redeploy server and browser bundles that include the library.
- Validate and reject keys such as
__proto__andconstructorin untrusted input before it reaches merge functions. - Consider the Node.js
--disable-protoflag or freezing built-in prototypes as extra layers, both of which the advisory lists as workarounds. - Search your code for calls to the listed APIs with data from requests, to learn where you are really exposed.
Why it matters
The record lists CWE-1321 (prototype pollution) and CWE-915 (improperly controlled modification of dynamically determined object attributes). In JavaScript, objects inherit properties from a shared prototype. If a merge function copies a key called __proto__ from untrusted data, it can write onto that shared prototype, and every object in the process starts to carry the attacker's property.
What comes next depends on how your code reads properties. Polluted values can flip an authorization check, change options passed to a library, or crash the service. Some of the worst cases chain with other gadget code to reach code execution. That is why the score is high even though the library itself does not run commands.
Immutable.js is a very common dependency, often pulled in by other packages, so many teams use it without knowing. Reachability matters here: a copy that never sees untrusted data through these APIs is less urgent than one that does, but patching is cheap enough to just do. Red Hat errata referenced in the record show distribution packages are also affected.
The record does not mark the CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version should a 4.x user choose?
Use 4.3.8. The advisory table and release list it, although the NVD text mentions 4.3.7.
Is validating input enough?
It is a workaround the advisory lists, and a good habit, but upgrading removes the weakness from the library itself.
Sources
Last reviewed: 19 October 2026.
