CVE-2026-29063: 
JavaScript vulnerability analysis and mitigation

CVE-2026-29063 is a Prototype Pollution vulnerability in the Immutable.js (immutable) npm library, affecting versions prior to 3.8.3, 4.3.7, and 5.1.5. The flaw allows unauthenticated remote attackers to manipulate object prototype attributes via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. It was disclosed on March 3, 2026 by the immutable-js maintainers and published to the GitHub Advisory Database on March 4, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Immutable-js Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). The affected APIs iterate over source object keys using ObjectSeq and assign values directly (e.g., merged[key] = value or object[k] = v) without filtering or guarding against the special __proto__ key, allowing an attacker-controlled __proto__ property in a crafted input to be written onto the object's prototype chain. Exploitation requires no authentication, no special privileges, and no user interaction — an attacker simply supplies a JSON payload containing a __proto__ key to any application endpoint that passes user-controlled data through the affected Immutable.js APIs. Public proof-of-concept code demonstrating privilege escalation via mergeDeep() and all other affected APIs is included in the official advisory (GitHub Advisory, Immutable-js Advisory).

Successful exploitation allows an attacker to inject arbitrary properties into JavaScript objects via prototype pollution, potentially bypassing security checks (e.g., privilege/role validation), modifying application behavior, or — depending on how the application uses the polluted prototype — achieving remote code execution. The pollution is scoped to the returned object rather than the global Object.prototype, but can still compromise confidentiality, integrity, and availability of the affected application. Numerous IBM enterprise products that bundle Immutable.js are affected, including IBM API Connect, App Connect Enterprise, Maximo Application Suite, Cloud Pak for AIOps, QRadar Suite, and many others, significantly broadening the attack surface (GitHub Advisory, Feedly).

Multiple proof-of-concept exploits are publicly available in the official GitHub Security Advisory, demonstrating privilege escalation and property injection across all affected APIs (GitHub Advisory). There is no confirmed evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.046% (0.08% per GitHub Advisory), placing it in the 24th percentile for exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 5008738) and Nessus (IDs: 301405, 303559) (Feedly).

1. Reconnaissance: Identify applications using a vulnerable version of the immutable npm package (< 3.8.3, < 4.3.7, or < 5.1.5) by inspecting package.json or package-lock.json files, or by using dependency scanning tools such as npm audit or Snyk.
2. Identify injection point: Locate an application endpoint that accepts user-controlled JSON input and passes it to one of the affected Immutable.js APIs: mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), or Map.toObject().
3. Craft malicious payload: Construct a JSON payload containing a __proto__ key with the desired injected properties, for example:

{"name": "Eve", "__proto__": {"role": "admin", "admin": true}}

4. Submit payload: Send the crafted JSON to the vulnerable endpoint (e.g., via an HTTP POST request body or query parameter that is processed by the affected API).
5. Trigger prototype pollution: The application calls mergeDeep(userProfile, requestBody) or a similar API; the library assigns merged['__proto__'] = {role: 'admin', admin: true}, injecting properties into the object's prototype chain.
6. Achieve objective: The injected properties (e.g., admin: true) become accessible on the merged object, bypassing security checks such as if (user.admin === true), enabling privilege escalation, unauthorized access, or further exploitation depending on application logic (GitHub Advisory, Immutable-js Advisory).

• Network: Unexpected HTTP requests containing JSON bodies with __proto__ keys targeting application endpoints that process user-supplied data through Immutable.js APIs; anomalous POST requests with deeply nested or unusual JSON structures.
• Logs: Application logs showing unexpected property values (e.g., admin: true, elevated roles) on objects that should not have them; errors or unexpected behavior in authorization/role-check logic following merge operations.
• Application Behavior: Privilege escalation events where users gain unexpected access levels; security checks returning unexpected results (e.g., isAdmin returning true for non-admin users) after processing user-supplied JSON.
• Dependency Audit: Presence of immutable npm package versions below 3.8.3, 4.3.7, or 5.1.5 in node_modules, package.json, or package-lock.json (GitHub Advisory).

Upgrade the immutable npm package to the patched versions: 3.8.3 (for 3.x users), 4.3.7 or 4.3.8 (for 4.x users), or 5.1.5 (for 5.x users) (GitHub Advisory, v3.8.3 Release, v5.1.5 Release). If immediate upgrade is not possible, the following workarounds can reduce risk: validate and sanitize all user input to reject or strip __proto__ keys before passing data to affected APIs; use the Node.js --disable-proto flag; create JavaScript objects with null prototypes (Object.create(null)); or avoid prototype lookups on merged objects. IBM has released security bulletins and patches for all affected enterprise products including API Connect, App Connect Enterprise, Maximo Application Suite, and others — consult the relevant IBM support pages for product-specific remediation guidance (IBM App Connect, IBM API Connect).

IBM issued over 25 security bulletins across its enterprise product portfolio acknowledging the impact of CVE-2026-29063, covering products such as API Connect, App Connect Enterprise, Maximo Application Suite, QRadar Suite, Cloud Pak for AIOps, and many others (IBM App Connect, IBM API Connect). Red Hat also issued multiple errata (e.g., RHSA-2026:7329, RHSA-2026:8490, RHSA-2026:8483) addressing the vulnerability in affected products. Atlassian referenced the vulnerability in its April 21, 2026 security bulletin. The vulnerability received coverage from security aggregators including VulnDB, Tenable (Nessus plugins 301405 and 303559), and Qualys, reflecting broad industry awareness of the supply-chain risk posed by this widely-used npm library.