CVE-2026-29063: Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-06 · updated 2026-10-30
Weakness: CWE-1321

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Affected products

immutable-js: from 3.0.0 before 3.8.3; from 4.0.0 before 4.3.8; from 5.0.0 before 5.1.5 — fixed in 3.8.3, 4.3.8, 5.1.5
3scale AMP before 2.0.0: 2.0 (and their updates)
Red Hat Advanced Cluster Management for Kubernetes 2: from 2.14 before 2.14.3; from 2.15 before 2.15.2; from 2.16 before 2.16.1 — fixed in 2.14.3, 2.15.2, 2.16.1
Red Hat Advanced Cluster Security for Kubernetes: from 4.8.0 before 4.8.11; from 4.9.0 before 4.9.6; from 4.10.0 before 4.10.2 — fixed in 4.8.11, 4.9.6, 4.10.2
Red Hat Ansible Automation Platform: 2.0 (and their updates)
RedHat Build Of Apicurio Registry: 2.0 (and their updates)
Redhat Connectivity Link: 1.0 (and their updates)
RedHat Developer Hub: from 1.8.0 before 1.8.6; from 1.9.0 before 1.9.4 — fixed in 1.8.6, 1.9.4
RedHat Discovery: 2.0 (and their updates)
Redhat Edge Manager: from 1.0 before 1.0.3; from 1.1 before 1.1.3 — fixed in 1.0.3, 1.1.3
Red Hat Enterprise Linux: 8.0, 9.0, 10.0 (and their updates)
Red Hat Logging Subsystem for Red Hat OpenShift: all versions
RedHat Migration Toolkit: 1.8 (and their updates)
Red Hat Migration Toolkit for Virtualization: 2.9.0, 2.10.0 (and their updates)
RedHat Multicluster Engine For Kubernetes: from 2.6 before 2.6.10; from 2.7 before 2.7.10; from 2.8 before 2.8.5; from 2.9 before 2.9.3; from 2.10 before 2.10.2; from 2.11 before 2.11.1 — fixed in 2.6.10, 2.7.10, 2.8.5, 2.9.3, 2.10.2, 2.11.1
RedHat Network Observability Operator: 1.11.0, 1.12.3 (and their updates)
Redhat Openshift Cluster Observability Operator: 1.5.3 (and their updates)
Red Hat OpenShift Container Platform 4.18: from 4.12 before 4.12.93; from 4.13 before 4.13.69; from 4.14 before 4.14.68; from 4.15 before 4.15.66; from 4.16 before 4.16.63; from 4.17 before 4.17.54 — fixed in 4.12.93, 4.13.69, 4.14.68, 4.15.66, 4.16.63, 4.17.54
Red Hat Openshift Data Foundation 4.22: from 4.18 before 4.18.25; from 4.19 before 4.19.20; from 4.20 before 4.20.15; 4.17 (and their updates) — fixed in 4.18.25, 4.19.20, 4.20.15
RedHat Openshift Gitops: all versions
Red Hat OpenShift Lightspeed: all versions
Red Hat OpenShift Pipelines: from 1.20 before 1.20.5 — fixed in 1.20.5
Red Hat OpenShift Service Mesh 2: 2.6, 3.0, 3.1, 3.2, 3.3 (and their updates)
RedHat Openshift Virtualization: 4 (and their updates)
Red Hat Quay 3: from 3.9.0 before 3.9.20; from 3.10.0 before 3.10.21; from 3.12.0 before 3.12.16; from 3.15.0 before 3.15.4; from 3.16.0 before 3.16.4; from 3.17.0 before 3.17.2 — fixed in 3.9.20, 3.10.21, 3.12.16, 3.15.4, 3.16.4, 3.17.2
Red Hat Satellite 6: 6.0, 6.18 (and their updates)
Redhat Self-Service Automation Portal: 2.0 (and their updates)
Npm Immutable: from 4.0.0-rc.1 before 4.3.8; from 5.0.0 before 5.1.5; before 3.8.3 — fixed in 4.3.8, 5.1.5, 3.8.3

How to fix

Upgrade to a fixed version: immutable-js 3.8.3, 4.3.8, 5.1.5; Red Hat Advanced Cluster Management for Kubernetes 2 2.14.3, 2.15.2, 2.16.1; Red Hat Advanced Cluster Security for Kubernetes 4.8.11, 4.9.6, 4.10.2; RedHat Developer Hub 1.8.6, 1.9.4; Redhat Edge Manager 1.0.3, 1.1.3; RedHat Multicluster Engine For Kubernetes 2.6.10, 2.7.10, 2.8.5, 2.9.3; Red Hat OpenShift Container Platform 4.18 4.12.93, 4.13.69, 4.14.68, 4.15.66; Red Hat Openshift Data Foundation 4.22 4.18.25, 4.19.20, 4.20.15; Red Hat OpenShift Pipelines 1.20.5; Red Hat Quay 3 3.9.20, 3.10.21, 3.12.16, 3.15.4; Npm Immutable 4.3.8, 5.1.5, 3.8.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-29063 or the next vulnerability affects your stack