CVE-2026-59879: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59879 is a Denial-of-Service vulnerability in Immutable.js (immutable npm package) caused by a 32-bit trie integer overflow in List operations. The affected methods — List#set, List#setSize, List#setIn, List#updateIn, and their functional equivalents — mishandle index or size values in the range [2^30, 2^31), leading to uncatchable infinite loops, unbounded memory allocation, or silent data corruption. All versions prior to 4.3.9 (v4 branch) and prior to 5.1.8 (v5 branch, including 5.0.0-beta.1 through 5.1.7) are affected. The vulnerability was disclosed on June 25, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is an integer overflow (CWE-190) in the setListBounds() function in src/List.js. Immutable.js stores List values in a 32-wide trie using signed 32-bit bitwise arithmetic; the level-raising loop condition 1 << (newLevel + SHIFT) wraps to a negative or small value once newLevel + SHIFT reaches 31 or 32 (JavaScript shift counts are taken mod 32), causing the loop exit condition to become permanently unreachable (CWE-835). Additionally, the begin |= 0 / end |= 0 ToInt32 coercion silently wraps large values (e.g., (2**31) | 0 === -2147483648), producing incorrect sizes without error (CWE-400, CWE-1284). Because numeric string indices are accepted (e.g., from a JSON request body or URL path), an attacker can supply a value like "1073741824" in a setIn key-path to trigger the bug remotely. Proof-of-concept code is publicly available in the security advisory (GitHub Advisory, Patch Commit v5).

Exploitation results in a pure availability impact with no confidentiality or integrity breach from the crash itself. An empty List subjected to an out-of-range index enters an uncatchable CPU-spinning infinite loop that cannot be recovered without killing the worker process; a populated List (≥32 elements) allocates memory without bound until the process aborts via SIGABRT (exit 134) or kernel OOM-kill (exit 137). A companion setSize bug silently corrupts application state by wrapping large size values to incorrect small values (e.g., setSize(2**31) yields size 0), which can affect data integrity in state management patterns such as redux-immutable reducers or JSON-Patch endpoints. A single 43-byte unauthenticated HTTP request is sufficient to crash a worker process in applications that route user-supplied paths into setIn/updateIn operations (GitHub Advisory).

Proof-of-concept exploit code is publicly available in the GitHub Security Advisory, consisting of standalone TypeScript/JavaScript snippets that directly trigger the infinite loop, OOM crash, and silent data corruption (GitHub Advisory). The vulnerability requires no authentication, no privileges, and no user interaction, and is classified as automatable by NVD SSVC. The EPSS score is approximately 0.30%, indicating a low but non-negligible probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog.

1. Identify a vulnerable target: Find a Node.js application using immutable npm package versions < 4.3.9 or 5.0.0-beta.1 through < 5.1.8 that accepts user-controlled input and passes it into a List operation (e.g., state.setIn(userPath, value) where userPath comes from a request body).
2. Craft a malicious payload: Construct an HTTP request body containing a numeric index in the range [2^30, 2^31) — for example, {"path":["items","1073741824"],"value":"x"}. The index 1073741824 (= 2^30) is the minimum trigger value; any value up to 2147483647 (2^31 - 1) works.
3. Send the request: Submit the crafted request to the target endpoint. A single 43-byte POST body is sufficient: {"path":["items","1073741824"],"value":"x"}.
4. Trigger the vulnerability: The server-side code executes state.setIn(path, value), which calls setListBounds() in src/List.js. The level-raising loop's exit condition wraps due to 32-bit overflow and becomes permanently unreachable.
5. Achieve DoS: On a populated List (≥32 elements), the process exhausts heap memory and aborts (SIGABRT/exit 134 or OOM-kill/exit 137) within approximately 2 seconds. On an empty List, the process hangs indefinitely in a CPU-spinning loop. Either outcome renders the worker unavailable (GitHub Advisory).

• Network: Repeated HTTP requests containing numeric path segments with values ≥ 1073741824 (2^30) in JSON bodies or URL parameters targeting endpoints that perform setIn/updateIn operations.
• Process: Node.js worker processes terminating unexpectedly with exit code 134 (SIGABRT) or exit code 137 (OOM-kill/SIGKILL); CPU usage spiking to 100% on a single core with no corresponding throughput (indicative of an infinite loop on an empty List).
• Logs: Application logs showing abrupt worker restarts or crash reports referencing heap exhaustion; absence of a caught exception or stack trace (the loop is uncatchable without the patch); process manager logs (e.g., PM2, systemd) recording repeated worker respawns in short succession.
• System: Kernel OOM-killer log entries (oom_kill_process) referencing the Node.js process; unusually high memory consumption growing rapidly to the configured heap limit (--max-old-space-size) before process termination (GitHub Advisory).

Upgrade immutable to version 4.3.9 (v4 branch) or 5.1.8 (v5 branch), which introduce a validateListBoundsRequest() guard that throws a catchable RangeError before the lossy int32 coercion occurs, and replace the unsafe 1 << exp shift with a levelCapacity() helper that uses 2 ** exp for exponents ≥ 31 (v4.3.9 Release, v5.1.8 Release). For users who cannot upgrade immediately, the advisory recommends validating and clamping all externally supplied List indices or setIn/updateIn key-path segments to values below 2^30 before passing them to Immutable.js. Additionally, running request handlers in isolated workers with a capped heap (--max-old-space-size) limits the blast radius of an OOM crash to a single restartable worker (GitHub Advisory).