CVE-2026-29063: Immutable.js Prototype Pollution via merge/toJS APIs

CVE-2026-29063 is a prototype pollution vulnerability (CWE-1321/CWE-915) in Immutable.js, a widely used JavaScript persistent-data-structures library, where functions including mergeDeep(), mergeDeepWith(), merge(), Map.toJS() and Map.toObject() fail to filter __proto__ keys from attacker-controlled input, letting an attacker inject properties onto individual object prototypes that can bypass authorization logic without necessarily touching the global Object.prototype, making the attack stealthy.

CVE-2026-29063 affects Immutable.js, the npm package (immutable) that provides persistent, immutable data structures and is a dependency of a large number of JavaScript and TypeScript applications. GitHub's security advisory identifies the root cause and the full set of vulnerable entry points: "Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs" (GitHub Security Advisory GHSA-wf6x-7x77-mvgw).

Unlike classic prototype pollution that corrupts the shared global Object.prototype and is comparatively easy to detect, this flaw lets an attacker inject a __proto__-keyed value that ends up as a property on an individual object's prototype chain. Because the pollution is scoped to specific objects rather than global state, it can silently satisfy property checks used in authorization or configuration logic (for example if (obj.isAdmin)) without the broad, often-noisy symptoms of a global pollution attack — the advisory frames this as enabling privilege escalation while remaining comparatively stealthy (GitHub Security Advisory GHSA-wf6x-7x77-mvgw).

The advisory lists three fixed releases, one per major version line still receiving patches: 3.8.3, 4.3.7, and 5.1.5 (Immutable.js release notes v3.8.3, v4.3.8, v5.1.5). For deployments that cannot upgrade immediately, the advisory recommends defense-in-depth measures: validating all untrusted input before it reaches these APIs, running Node.js with the --disable-proto flag, freezing/locking down built-in prototype objects, preferring objects created with a null prototype, and avoiding prototype-chain-based property lookups on attacker-influenced data (GitHub Security Advisory GHSA-wf6x-7x77-mvgw).

NVD's own analysis rates this CVSS v3.1 Primary 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or interaction required, full impact across confidentiality, integrity, and availability. GitHub's own CNA submission scored it somewhat lower, CVSS v3.1 8.8 (Secondary, requiring low privileges) and CVSS v4.0 8.7; this page follows NVD's Primary rating as authoritative (NVD). Red Hat has shipped dozens of RHSA errata backporting the fix across downstream products that bundle Immutable.js, reflecting how deeply the package is embedded in the broader npm ecosystem.

As of this review, the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match, and FIRST scores the probability of exploitation at 0.01015 (63.247th percentile) as of 2026-10-30 — moderate, consistent with a widely-used library flaw that requires an application to pass attacker-controlled data into one of the five named APIs rather than being exploitable against every Immutable.js consumer by default (FIRST EPSS; CISA KEV catalog). Any application that calls mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), or Map.toObject() on JSON or other untrusted input should upgrade to 3.8.3/4.3.7/5.1.5 and treat any audit logic relying on per-object property checks as potentially bypassable until patched.

• Prototype pollution is possible via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs by injecting a __proto__ key, which sets properties on individual object prototypes rather than the global Object.prototype. — GitHub Security Advisory GHSA-wf6x-7x77-mvgw
• Fixed in versions 3.8.3, 4.3.7, and 5.1.5; workarounds for deployments that cannot upgrade include input validation, Node's --disable-proto flag, freezing built-ins, and using null-prototype objects. — GitHub Security Advisory GHSA-wf6x-7x77-mvgw
• NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; GitHub's CNA Secondary score is lower (v3.1 8.8, v4.0 8.7). — NVD
• EPSS score is 0.01015 (63.247th percentile) as of 2026-10-30; the CVE is confirmed absent from the live CISA KEV catalog by exact cveID match this run. — FIRST EPSS