--- id: CVE-2026-59879 title: >- immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879) summary: >- A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a partic… severity: medium cvss: 5.3 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L' cvssSource: vendor cwe: - CWE-1285 - CWE-190 - CWE-400 - CWE-835 - CWE-1284 vendor: Red Hat product: Red Hat Satellite 6.19 for RHEL 9 affected: - cryostat 4 - logging_subsystem_for_red_hat_openshift - migration_toolkit_for_containers - migration_toolkit_for_virtualization - network_observability_operator - node_healthcheck_operator - openshift_lightspeed - openshift_pipelines - openshift_service_mesh 2 - 3scale_api_management_platform 2 - advanced_cluster_security 4 - ansible_automation_platform 2 - connectivity_link 1 - edge_manager 1 - enterprise_linux 10 - enterprise_linux 8 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_gitops - openshift_virtualization 4 - satellite 6 - satellite_6_19_for_rhel 9 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - discovery 2 - openshift_container_platform 4.19 - openshift_container_platform 4.21 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - quay 3.10 - quay 3.12 - quay 3.16 - quay 3.9 - satellite 6.18 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 patched: - satellite_6_19_for_rhel 9 - advanced_cluster_management_for_kubernetes 2.14 - ansible_automation_platform 2.1 - discovery 2 - openshift_container_platform 4.19 - openshift_container_platform 4.21 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - quay 3.10 - quay 3.12 - quay 3.16 - quay 3.9 - satellite 6.18 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 published: '2026-07-08' updated: '2026-10-15' sourceUpdated: '2026-10-15T11:20:18+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59879.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59879.json - url: 'https://access.redhat.com/security/cve/CVE-2026-59879' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2498158' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59879' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59879' - url: >- https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84 - url: >- https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a - url: 'https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9' - url: 'https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8' - url: >- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735 - url: 'https://access.redhat.com/errata/RHSA-2026:74503' - url: 'https://access.redhat.com/errata/RHSA-2026:67539' - url: 'https://access.redhat.com/errata/RHSA-2026:72712' - url: 'https://access.redhat.com/errata/RHSA-2026:69289' - url: 'https://access.redhat.com/errata/RHSA-2026:74435' - url: 'https://access.redhat.com/errata/RHSA-2026:74384' - url: 'https://access.redhat.com/errata/RHSA-2026:68687' - url: 'https://access.redhat.com/errata/RHSA-2026:68689' - url: 'https://access.redhat.com/errata/RHSA-2026:68691' - url: 'https://access.redhat.com/errata/RHSA-2026:79366' - url: 'https://access.redhat.com/errata/RHSA-2026:79546' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:77656' - url: 'https://access.redhat.com/errata/RHSA-2026:68756' - url: 'https://access.redhat.com/errata/RHSA-2026:68765' - url: 'https://access.redhat.com/errata/RHSA-2026:72850' - url: 'https://access.redhat.com/errata/RHSA-2026:72854' - url: 'https://access.redhat.com/errata/RHSA-2026:72851' - url: 'https://github.com/immutable-js/immutable-js/releases/tag/v3.8.4' - url: 'https://github.com/advisories/GHSA-v56q-mh7h-f735' tags: - csaf - vex - red-hat - ghsa - npm - score-dispute epss: 0.00575 epssPercentile: 0.47272 aliases: - GHSA-v56q-mh7h-f735 ecosystem: npm scores: vendor: 5.3 ghsa: 7.5 ingestedAt: '2026-07-21T18:53:06.514Z' --- ## Overview A flaw was found in Immutable.js, a library providing persistent immutable data structures. This vulnerability occurs when specific List operations, such as List#set or List#setSize, are provided with an index or size value within a particular large range. An attacker could exploit this by providing specially crafted input, leading to an uncatchable infinite loop or unbounded memory allocation, ultimately causing a Denial of Service (DoS) for applications using the library. ## Vendor advisories - **RHSA-2026:74503** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74503) - **RHSA-2026:67539** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67539) - **RHSA-2026:72712** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72712) - **RHSA-2026:69289** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69289) - **RHSA-2026:74435** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-10-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:74435) - **RHSA-2026:74384** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:74384) - **RHSA-2026:68687** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.0 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68687) - **RHSA-2026:68689** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.1 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68689) - **RHSA-2026:68691** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.2 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68691) - **RHSA-2026:79366** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79366) - **RHSA-2026:79546** · Red Hat · fixed in: Red Hat Quay 3.12 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79546) - **Red Hat VEX** · Moderate · affected: Cryostat 4, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Containers, Migration Toolkit for Virtualization, Network Observability Operator, Node HealthCheck Operator, … · no fix planned: Migration Toolkit for Virtualization, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Security 4, Red Hat Enterprise Linux 10, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59879.json) - **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255) - **RHSA-2026:68756** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68756) - **RHSA-2026:68765** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68765) - **RHSA-2026:72850** · Red Hat · fixed in: multicluster engine for Kubernetes 2.6 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72850) - **RHSA-2026:72854** · Red Hat · fixed in: multicluster engine for Kubernetes 2.8 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72854) **immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations** — rated Moderate by Red Hat. Released 2026-07-08, updated 2026-10-15. Affected: - Cryostat 4 - Logging Subsystem for Red Hat OpenShift - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Network Observability Operator - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Service Mesh 2 - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Connectivity Link 1 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift GitOps - Red Hat OpenShift Virtualization 4 - Red Hat Satellite 6 Fixed: - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Ansible Automation Platform 2.1 - Red Hat Discovery 2 - Red Hat OpenShift Container Platform 4.19 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.16 - Red Hat Quay 3.9 - Red Hat Satellite 6.18 - multicluster engine for Kubernetes 2.6 - multicluster engine for Kubernetes 2.8 - multicluster engine for Kubernetes 2.9 No fix planned: - Migration Toolkit for Virtualization - Red Hat 3scale API Management Platform 2 - Red Hat Advanced Cluster Security 4 - Red Hat Enterprise Linux 10 - Red Hat OpenShift GitOps - Cryostat 4 - Logging Subsystem for Red Hat OpenShift - Migration Toolkit for Containers - Network Observability Operator - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Service Mesh 2 - Red Hat Ansible Automation Platform 2 - Red Hat Connectivity Link 1 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 8 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Virtualization 4 - Red Hat Satellite 6 Not affected: - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Discovery 2 - Red Hat OpenShift Container Platform 4.19 - Red Hat OpenShift Container Platform 4.21 - Red Hat Quay 3.10 - Red Hat Quay 3.12 - Red Hat Quay 3.16 - Red Hat Quay 3.9 - Cryostat 4 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:74503 Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67539 For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:72712 Workarounds / mitigations: - To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort. ## Package advisory (CVE-2026-59879) Affected packages: - `immutable >= 5.0.0-beta.1, < 5.1.8` - `immutable >= 4.0.0-rc.1, < 4.3.9` - `immutable < 3.8.4` Patched in: - `immutable 5.1.8` - `immutable 4.3.9` - `immutable 3.8.4` Source: https://github.com/advisories/GHSA-v56q-mh7h-f735