Prototype pollution in Immutable.js - CVE-2026-29063

Vulnerability identifier: #VU124825

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-29063

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify object prototype attributes in affected JavaScript objects.

The vulnerability exists due to improper input validation in the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() functions when processing user-supplied input containing __proto__ properties. A remote attacker can send a specially crafted object input to pollute the prototype of base objects, leading to unauthorized property injection and potential privilege escalation.

Prototype pollution occurs without affecting the global Object.prototype, but injected properties can still be accessed through object property lookups even if not visible via Object.keys().

Immutable.js
Enterprise Application Runtimes
PowerVM NovaLink
Financial Transaction Manager for RedHat OpenShift
Storage Fusion Data Foundation
Cloud Pak for Applications
WebSphere Hybrid Edition
Maximo Application Suite - Monitor Component
Data Product Hub
Db2 Big SQL
Robotic Process Automation for Cloud Pak
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Tivoli Netcool Impact
IBM Tivoli Netcool/OMNIbus WebGUI
IBM TXSeries for Multiplatforms
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
Confluence Data Center
Jira Service Management Data Center
Jira Software Data Center
IBM Business Automation Workflow
IBM Automation Decision Services
App Connect Enterprise Certified Container
IBM i
IBM DataPower Gateway
Red Hat OpenShift Container Platform
IBM InfoSphere Information Server
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install security update from vendor's website.

Immutable.js - addressed in versions 4.3.8, 5.1.5
PowerVM NovaLink - addressed in versions 2.1.1-260428, 2.2.1.1-260428, 2.3.2-260422
Financial Transaction Manager for RedHat OpenShift - update to 4.0.9.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
IBM Tivoli Netcool Impact - update to 7.1.0.38
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix19
Maximo Application Suite - Monitor Component - addressed in versions 8.10.30, 8.11.28, 9.0.20, 9.1.10
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.5
Jira Software Data Center - update to 10.3.23
IBM DataPower Gateway - addressed in versions 10.6.0.9, 11.0.0.0
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM Business Automation Workflow - addressed in versions 24.0.0-IF009, 24.0.1-IF008, 25.0.0-IF005, 26.0.0.0
IBM Automation Decision Services - addressed in versions 24.0.0.0.9, 24.0.1.0.8, 25.0.0.0.4
Red Hat OpenShift Container Platform - addressed in versions 4.12.93, 4.16.66, 4.17.55, 4.18.46, 4.19.36
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.18.25, 4.19.20
Data Product Hub - addressed in versions 5.3.1 Patch 7, 5.4.0
Db2 Big SQL - update to 8.3.1 patch 4
App Connect Enterprise Certified Container - addressed in versions 12.0.22, 13.0.0
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.6, 30.0.2

• https://github.com/advisories/GHSA-wf6x-7x77-mvgw
• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw

• Prototype pollution in Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in IBM i
• IBM DataPower Gateway update for Immutable.js
• IBM App Connect Enterprise Certified Container update for Immutable.js
• Prototype pollution in IBM Cloud Pak for Applications
• Prototype pollution in IBM Enterprise Application Runtimes
• Prototype pollution in IBM WebSphere Hybrid Edition
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Confluence Data Center update for Immutable.js
• IBM PowerVM Novalink update for Immutable.js
• IBM Maximo Application Suite - Monitor Component update for Immutable.js
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• IBM Robotic Process Automation for Cloud Pak update for Immutable.js
• IBM Big SQL on Cloud Pak for Data update for Immutable.js
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• IBM Watson Discovery Cartridge update for Immutable.js
• IBM Maximo Application Suite - Manage Component update for Immutable.js
• IBM Sterling Connect:Direct Web Services update for Immutable.js
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.18
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.18
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• IBM Fusion Data Foundation update for Immutable.js
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Business Automation Workflow