Integer overflow in Immutable.js - #VU135793
Published: June 29, 2026
Vulnerability identifier: #VU135793
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to corrupt application state.
The vulnerability exists due to integer overflow in List#setSize when coercing large finite values with signed 32-bit arithmetic. A remote attacker can supply a specially crafted size value to corrupt application state.
The issue silently truncates or wraps large sizes, such as clearing the List or producing an incorrect smaller size instead of raising an error.
Affected software
Immutable.js
Remediation
Install security update from vendor's website.
Immutable.js - addressed in versions 4.3.9, 5.1.8