org.webjars.npm:immutable 3.8.2

Direct Vulnerabilities

Known vulnerabilities in the org.webjars.npm:immutable package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Integer Overflow or Wraparound Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 30 to 2 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values. How to fix Integer Overflow or Wraparound? Upgrade `org.webjars.npm:immutable` to version 4.3.9, 5.1.8 or higher.	[,4.3.9)[5.0.0-beta.1,5.1.8)
H Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects. How to fix Inefficient Algorithmic Complexity? Upgrade `org.webjars.npm:immutable` to version 4.3.9, 5.1.8 or higher.	[,4.3.9)[5.0.0-beta.1,5.1.8)
C Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution in the `mergeDeep`, `mergeDeepWith`, `merge`, `Map.toJS`, and `Map.toObject` functions. An attacker can inject arbitrary properties into object prototypes by supplying crafted input containing special keys, potentially leading to privilege escalation or bypassing security checks. How to fix Prototype Pollution? A fix was pushed into the `master` branch but not yet published.	[0,)

Vulnerability

Vulnerable Version

Integer Overflow or Wraparound

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the setListBounds function in src/List.js when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.

How to fix Integer Overflow or Wraparound?

Upgrade org.webjars.npm:immutable to version 4.3.9, 5.1.8 or higher.

[,4.3.9)[5.0.0-beta.1,5.1.8)

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the HashCollisionNode class in Immutable.Map and Immutable.Set. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.

How to fix Inefficient Algorithmic Complexity?

Upgrade org.webjars.npm:immutable to version 4.3.9, 5.1.8 or higher.

[,4.3.9)[5.0.0-beta.1,5.1.8)

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution in the mergeDeep, mergeDeepWith, merge, Map.toJS, and Map.toObject functions. An attacker can inject arbitrary properties into object prototypes by supplying crafted input containing special keys, potentially leading to privilege escalation or bypassing security checks.

How to fix Prototype Pollution?

A fix was pushed into the master branch but not yet published.

[0,)

org.webjars.npm:immutable@3.8.2

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically