Prototype pollution in Immutable.js - CVE-2026-29063

Vulnerability identifier: #VU124825

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-29063

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify object prototype attributes in affected JavaScript objects.

The vulnerability exists due to improper input validation in the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() functions when processing user-supplied input containing __proto__ properties. A remote attacker can send a specially crafted object input to pollute the prototype of base objects, leading to unauthorized property injection and potential privilege escalation.

Prototype pollution occurs without affecting the global Object.prototype, but injected properties can still be accessed through object property lookups even if not visible via Object.keys().

Immutable.js
Enterprise Application Runtimes
PowerVM NovaLink
Financial Transaction Manager for RedHat OpenShift
Storage Fusion Data Foundation
WebSphere Hybrid Edition
Cloud Pak for Applications
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect Operations Center
Storage Protect Client
Storage Protect for Space Management
Maximo Application Suite - Monitor Component
QRadar Threat Intelligence
Data Product Hub
Db2 Big SQL
Robotic Process Automation for Cloud Pak
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Tivoli Netcool Impact
IBM Tivoli Netcool/OMNIbus WebGUI
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
IBM Business Automation Workflow
IBM Automation Decision Services
App Connect Enterprise Certified Container
IBM i
IBM DataPower Gateway
Red Hat OpenShift Container Platform
IBM InfoSphere Information Server
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install security update from vendor's website.

Immutable.js - addressed in versions 4.3.8, 5.1.5
PowerVM NovaLink - addressed in versions 2.1.1-260428, 2.2.1.1-260428, 2.3.2-260422
Financial Transaction Manager for RedHat OpenShift - update to 4.0.9.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
IBM Tivoli Netcool Impact - update to 7.1.0.38
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.2.0
Storage Protect Operations Center - update to 8.2.2
Storage Protect Client - update to 8.2.2.0
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
Storage Protect for Space Management - update to 8.2.2.0
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix19
Maximo Application Suite - Monitor Component - addressed in versions 8.10.30, 8.11.28, 9.0.20, 9.1.10
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.5
Jira Software Data Center - update to 10.3.23
IBM DataPower Gateway - addressed in versions 10.6.0.9, 11.0.0.0
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
IBM Automation Decision Services - addressed in versions 24.0.0.0.9, 24.0.1.0.8, 25.0.0.0.4
QRadar Threat Intelligence - update to 2.6.0
Red Hat OpenShift Container Platform - addressed in versions 4.12.93, 4.16.66, 4.17.55, 4.18.46, 4.19.36
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20
Data Product Hub - addressed in versions 5.3.1 Patch 7, 5.4.0
Db2 Big SQL - update to 8.3.1 patch 4
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 13.0.0
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.6, 30.0.2

• https://github.com/advisories/GHSA-wf6x-7x77-mvgw
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw

• Prototype pollution in Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM i
• IBM DataPower Gateway update for Immutable.js
• IBM App Connect Enterprise Certified Container update for Immutable.js
• Prototype pollution in IBM Cloud Pak for Applications
• Prototype pollution in IBM Enterprise Application Runtimes
• Prototype pollution in IBM WebSphere Hybrid Edition
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Confluence Data Center update for Immutable.js
• IBM PowerVM Novalink update for Immutable.js
• IBM Maximo Application Suite - Monitor Component update for Immutable.js
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• IBM Robotic Process Automation for Cloud Pak update for Immutable.js
• IBM Big SQL on Cloud Pak for Data update for Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• IBM Watson Discovery Cartridge update for Immutable.js
• IBM Maximo Application Suite - Manage Component update for Immutable.js
• IBM Sterling Connect:Direct Web Services update for Immutable.js
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• IBM Fusion Data Foundation update for Immutable.js
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Business Automation Workflow
• IBM Storage Protect Operations Center update for Immutable.js
• IBM Storage Protect Client and Virtual Environments update for Immutable.js
• IBM Storage Protect for Space Management update for Immutable.js
• Multiple vulnerabilities in IBM QRadar Threat Intelligence