Technical impact
A 32‑bit trie overflow in Immutable.js’s List implementation is triggered when List methods such as set, setSize, setIn, updateIn, or their functional equivalents receive an index or size between 2^30 and 2^31. The bad handling causes an empty List to enter an infinite loop or a populated List to allocate memory without bound until the process aborts, resulting in a denial of service. The flaw is expressed by Integer Overflow (CWE‑190), Unbounded Resource Consumption (CWE‑400), and infinite loop conditions (CWE‑835).
Affected Systems
The vulnerability affects the immutable-js:immutable-js package in any Node.js, browser, or JavaScript environment that imports an unpatched version of the library. Versions earlier than 4.3.9 in the 4.x series and earlier than 5.1.8 in the 5.x series are susceptible. Any application that calls List#set, List#setSize, List#setIn, List#updateIn, or the functional set, setIn, updateIn functions with indices or sizes in the vulnerable range is at risk.
Risk and Exploitability
The CVSS base score of 8.7 marks the flaw as high severity, yet the EPSS score of < 1% indicates a very low likelihood of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to supply a large index or size to the vulnerable List operations; a crafted payload that forces a List to use a value between 2^30 and 2^31 can trigger resource exhaustion or an infinite loop, causing the application to become unavailable. If an application sanitizes or limits such values, the risk is substantially reduced, but the high CVSS score still warrants prompt remediation.
Github GHSA