The vulnerability is a 32‑bit trie overflow in Immutable.js’s List implementation that triggers an infinite loop or unbounded memory allocation when List methods such as set, setSize, setIn, updateIn, or their functional equivalents receive an index or size in the range 2^30 to 2^31. The effect is a process that either hangs indefinitely or consumes all memory until it aborts, resulting in a denial of service. This weakness is represented by Integer Overflow (CWE‑190), Unbounded Resource Consumption (CWE‑400), and infinite loop conditions (CWE‑835).

The issue targets the immutable-js library, specifically any version earlier than 4.3.9 in the 4.x line or earlier than 5.1.8 in the 5.x line. Any application—Node.js, browser, or other JavaScript environment—that imports immutable-js and invokes List methods such as set, setSize, setIn, updateIn, or the functional set, setIn, updateIn functions is at risk if it can provide an index or size within the vulnerable range.

The CVSS base score of 8.7 marks the flaw as high severity, but the EPSS score of < 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to supply a large index or size to List operations; a crafted payload that forces a List to use a value between 2^30 and 2^31 can trigger resource exhaustion or an infinite loop, causing the application to become unavailable. If an application disallows such large values or does not expose them to untrusted input, the risk is reduced. Nonetheless, the high CVSS score warrants prompt remediation.