CVE-2026-29063
Published: 06 March 2026
Summary
CVE-2026-29063 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Immutable-Js Immutable. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-29063 is a prototype pollution vulnerability (CWE-1321) in the Immutable.js JavaScript library, which provides persistent immutable data structures. The flaw affects versions prior to 3.8.3, 4.3.7, and 5.1.5, where attackers can exploit it through the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity. Successful exploitation enables prototype pollution, allowing modification of the Object prototype and potentially leading to arbitrary code execution, denial of service, or other impacts depending on how the library is used in the application.
The issue has been patched in Immutable.js versions 3.8.3, 4.3.7, and 5.1.5, as detailed in the project's GitHub security advisory (GHSA-wf6x-7x77-mvgw) and corresponding release notes. Security practitioners should prioritize upgrading affected applications to these fixed versions to mitigate the vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10057
Vulnerability details
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution vulnerability in public-facing JavaScript library enables remote unauthenticated exploitation of web applications, directly mapping to Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely patching of the vulnerable Immutable.js library to fixed versions 3.8.3, 4.3.7, or 5.1.5, eliminating the prototype pollution flaw.
Requires vulnerability scanning that would identify the presence of vulnerable Immutable.js versions affected by CVE-2026-29063.
Enforces input validation and sanitization to block malicious payloads targeting the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.