CVE-2026-59879

A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library.

This Moderate impact denial of service vulnerability in Immutable.js affects Red Hat products that process untrusted input through List operations. An attacker can trigger an infinite loop or unbounded memory allocation by providing specially crafted large index values, leading to a service disruption. Additionally, silent data corruption may occur due to integer wrapping.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using --max-old-space-size) can contain the impact of a potential process abort.