Prototype pollution in Immutable.js - CVE-2026-29063

Detailed vulnerability description

The vulnerability allows a remote attacker to modify object prototype attributes in affected JavaScript objects.

The vulnerability exists due to improper input validation in the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() functions when processing user-supplied input containing __proto__ properties. A remote attacker can send a specially crafted object input to pollute the prototype of base objects, leading to unauthorized property injection and potential privilege escalation.

Prototype pollution occurs without affecting the global Object.prototype, but injected properties can still be accessed through object property lookups even if not visible via Object.keys().

How to mitigate CVE-2026-29063

Sources

• https://github.com/advisories/GHSA-wf6x-7x77-mvgw
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw