CVE-2026-59879

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.

• CWE-190
• CWE-400
• CWE-835
• CWE-1284

• https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84Patch
• https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304aPatch
• https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9Product, Release Notes
• https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8Product, Release Notes
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735Exploit, Mitigation, Vendor Advisory
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735Exploit, Mitigation, Vendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 10, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59873node-tar is a tar archive manipulation library for Node.js. …7.5
• CVE-2026-59874node-tar is a tar archive manipulation library for Node.js. …7.5
• CVE-2026-59875node-tar is a tar archive manipulation library for Node.js. …5.3
• CVE-2026-59876protobufjs compiles protobuf definitions into JavaScript (JS…4.8
• CVE-2026-59877protobufjs compiles protobuf definitions into JavaScript (JS…7.5
• CVE-2026-59878Improper Input Validation vulnerability in Apache ActiveMQ A…7.5
• CVE-2026-5988A vulnerability was detected in Tenda F451 1.0.0.7. This imp…8.8
• CVE-2026-59880Immutable.js provides many Persistent Immutable data structu…7.5
• CVE-2026-59881AIOHTTP is an asynchronous HTTP client/server framework for …6.9
• CVE-2026-59882guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…6.5
• CVE-2026-59883Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, Co…6.1
• CVE-2026-59884pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4…7.5