Immutable.js, a library for persistent immutable data structures, exposes a prototype pollution flaw in several APIs. Prior to releases 3.8.3, 4.3.7, and 5.1.5, functions such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() can alter properties on Object.prototype when fed crafted input. This uncontrolled change corresponds to CWE‑1321 and could allow an attacker to inject malicious properties into every object created thereafter, undermining application integrity and potentially enabling denial‑of‑service.

The vulnerability affects the Immutable.js library for JavaScript. Any installation using a version older than 3.8.3, 4.3.7, or 5.1.5 is susceptible. The issue was fixed in the corresponding release versions and all later updates.

The CVSS score is 8.7, placing this bug in the high severity range, while the EPSS score of less than 1 % indicates a low likelihood of exploitation. It is not listed in the KEV catalog. Based on the description, the attack vector is likely any scenario where an attacker supplies crafted data to the vulnerable APIs, allowing them to modify the global prototype chain and potentially compromise application functionality.