Immutable.js, a library providing persistent immutable data structures, has a vulnerability in versions before 4.3.9 and 5.1.8. The methods List#set, List#setSize, List#setIn, List#updateIn, and the functional equivalents mishandle index or size values in the range 2^30 to 2^31 within the setListBounds function in src/List.js. This mishandling causes an empty List to enter an uncatchable infinite loop, a populated List to allocate memory without bound until the process aborts, or setSize to silently wrap large values. These issues are resolved in versions 4.3.9 and 5.1.8.

The vulnerability can cause denial of service conditions by triggering infinite loops or excessive memory allocation leading to process aborts. Silent wrapping of large size values may cause unexpected behavior in applications using the affected Immutable.js versions. There are no known exploits in the wild at this time.

Upgrade Immutable.js to version 4.3.9 or later, or 5.1.8 or later, where the issue is fixed. The affected versions explicitly include =3.8.2+dfsg-3, =4.0.0-1, =4.0.0-2, =4.1.0-3, =4.3.4-1, and =4.3.8-2. No other mitigations are indicated.