The vulnerability in Immutable.js List arises from the use of signed 32-bit bitwise arithmetic in the internal 32-wide trie implementation. Operations like set, setIn, updateIn, and setSize mishandle indices or sizes ≥ 2^30 due to JavaScript's 32-bit shift behavior causing infinite loops or heap exhaustion. On empty Lists, this results in an infinite CPU spin that cannot be caught by try/catch. On populated Lists, it causes unbounded memory allocation leading to process aborts (SIGABRT or OOM kills). The setSize method also silently corrupts List size by wrapping large values due to coercion to 32-bit integers. The root cause is a loop relying on 1 << (newLevel + SHIFT) which wraps and causes the loop to never terminate. The fix involves upfront validation to throw RangeErrors for sizes exceeding 2^30 and replacing the shift operation with a safe non-wrapping alternative. This vulnerability affects versions before 4.3.9.

This vulnerability impacts availability by causing denial of service through infinite loops or process crashes when untrusted input controls List indices or key-paths. It can be triggered remotely with a small unauthenticated request. There is no impact on confidentiality, integrity, or remote code execution. The companion setSize issue can silently corrupt application state by incorrectly resizing Lists without crashing.

A fix is available in Immutable.js version 4.3.9 and later. Users should upgrade to version 4.3.9 or newer to prevent this vulnerability. The fix adds upfront validation to reject indices or sizes exceeding 2^30 with a catchable RangeError and replaces unsafe bitwise shifts with safe computations to prevent infinite loops and memory exhaustion. Until upgrading, avoid passing untrusted input as List indices or key-paths in affected methods. Patch status is confirmed by the vendor advisory indicating the fix in version 4.3.9.