Immutable.js, a library providing persistent immutable data structures, has a performance degradation vulnerability in versions before 4.3.9 and 5.1.8. Specifically, Immutable.Map and Immutable.Set use a HashCollisionNode to store keys with identical 32-bit hashes, which is scanned linearly. An attacker who can control keys inserted into these maps (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), or merge operations) can create many colliding keys, causing insertion and lookup operations to degrade significantly and consume disproportionate CPU resources. This vulnerability is addressed by updates in versions 4.3.9 and 5.1.8.

The vulnerability allows an attacker with the ability to control keys inserted into Immutable.js data structures to cause significant CPU resource consumption by exploiting hash collisions. This can degrade application performance and potentially lead to denial of service conditions due to excessive CPU usage. There is no indication of data corruption or unauthorized access from the provided information.

A fix is available in Immutable.js versions 4.3.9 and 5.1.8. Users should upgrade to these or later versions to remediate the vulnerability. The affected Ubuntu package versions listed should be updated accordingly. No other mitigation actions are indicated.