Technical impact
Immutable.js provides persistent immutable structures such as Map and Set. In versions older than 4.3.9 and 5.1.8, a HashCollisionNode stores keys with identical 32‑bit hashes in a linear‑scan bucket. If an attacker controls the keys inserted into a Map or Set—for example, by calling Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep—they can create many colliding keys, forcing each insert or lookup to traverse the entire bucket. This linear degradation consumes disproportionate CPU cycles and can cause the application to become unresponsive, resulting in denial of service.
Affected Systems
Applications that import the immutable-js library and use Map or Set data structures are affected. The flaw exists in all releases prior to 4.3.9 and 5.1.8; upgrading to these versions removes the linear collision scanning.
Risk and Exploitability
The CVSS score of 8.7 signifies high severity, yet the EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to supply crafted keys to a Map or Set, which typically occurs when untrusted data is merged into application state or directly assigned to a Immutable structure. An attacker with such capability can force CPU exhaustion and trigger a denial of service.
Github GHSA