Threats Tagged 'cve-2026-59880'

Immutable.js versions through 5.1.7 have a denial of service vulnerability due to a hash-collision algorithmic complexity issue in Immutable.Map and Immutable.Set. Attackers controlling keys inserted into these structures can craft many keys with identical 32-bit hashes, causing insertion and lookup operations to degrade from O(1) to O(n) and resulting in O(n²) complexity for building or reading the entire set. This can consume excessive CPU and stall single-threaded runtimes like Node.js, causing denial of service. The issue is fixed in version 5.1.8 by introducing a per-process seeded secondary hash to index large collision buckets, restoring near-linear performance. Workarounds include limiting request body size and object key counts before passing untrusted data to Immutable.js.

Immutable.js versions prior to 4.3.9 and 5.1.8 contain a vulnerability in their handling of hash collisions within Immutable.Map and Immutable.Set. Attackers who can control keys inserted into these data structures may craft many colliding keys, causing linear scanning of collision buckets and resulting in excessive CPU consumption. This vulnerability affects certain Ubuntu package versions and is fixed in Immutable.js versions 4.3.9 and 5.1.8.