immutable 4.0.0-rc.1

Direct Vulnerabilities

Known vulnerabilities in the immutable package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Integer Overflow or Wraparound Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 30 to 2 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values. How to fix Integer Overflow or Wraparound? Upgrade `immutable` to version 4.3.9, 5.1.8 or higher.	<4.3.9>=5.0.0-beta.1 <5.1.8
H Inefficient Algorithmic Complexity Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects. How to fix Inefficient Algorithmic Complexity? Upgrade `immutable` to version 4.3.9, 5.1.8 or higher.	<4.3.9>=5.0.0-beta.1 <5.1.8
C Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution in the `mergeDeep`, `mergeDeepWith`, `merge`, `Map.toJS`, and `Map.toObject` functions. An attacker can inject arbitrary properties into object prototypes by supplying crafted input containing special keys, potentially leading to privilege escalation or bypassing security checks. How to fix Prototype Pollution? Upgrade `immutable` to version 3.8.3, 4.3.8, 5.1.5 or higher.	<3.8.3>=4.0.0-rc.1 <4.3.8>=5.0.0-beta.1 <5.1.5

Vulnerability

Vulnerable Version

Integer Overflow or Wraparound

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the setListBounds function in src/List.js when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.

How to fix Integer Overflow or Wraparound?

Upgrade immutable to version 4.3.9, 5.1.8 or higher.

<4.3.9>=5.0.0-beta.1 <5.1.8

Inefficient Algorithmic Complexity

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the HashCollisionNode class in Immutable.Map and Immutable.Set. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.

How to fix Inefficient Algorithmic Complexity?

Upgrade immutable to version 4.3.9, 5.1.8 or higher.

<4.3.9>=5.0.0-beta.1 <5.1.8

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution in the mergeDeep, mergeDeepWith, merge, Map.toJS, and Map.toObject functions. An attacker can inject arbitrary properties into object prototypes by supplying crafted input containing special keys, potentially leading to privilege escalation or bypassing security checks.

How to fix Prototype Pollution?

Upgrade immutable to version 3.8.3, 4.3.8, 5.1.5 or higher.

<3.8.3>=4.0.0-rc.1 <4.3.8>=5.0.0-beta.1 <5.1.5

immutable@4.0.0-rc.1

Immutable Data Collections

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically