CVE-2026-29063
EUVD-2026-1005706.03.2026, 19:16
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| immutable-js | immutable | 3.0.0 ≤ 𝑥 < 3.8.3 |
| immutable-js | immutable | 4.0.0 ≤ 𝑥 < 4.3.7 |
| immutable-js | immutable | 5.0.0 ≤ 𝑥 < 5.1.5 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839279 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782840539 ≤ 𝑥 < * | ADP |
| Red Hat | Cluster Observability Operator 1.5.0 | 1782839996 ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.1 | 1779139872 ≤ 𝑥 < * | ADP |
| Red Hat | Migration Toolkit for Virtualization 2.9 | 1778927462 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.10 | 1777128790 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.11 | 1777559392 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.6 | 1776223790 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.7 | 1777306226 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.8 | 1775116156 ≤ 𝑥 < * | ADP |
| Red Hat | multicluster engine for Kubernetes 2.9 | 1777301444 ≤ 𝑥 < * | ADP |
| Red Hat | Network Observability \(NETOBSERV\) 1.11.2 | 1774431617 ≤ 𝑥 < * | ADP |
| Red Hat | Network Observability \(NETOBSERV\) 1.12.1 | 1780920979 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.14 | 1783451729 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 | 1776927126 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.16 | 1777559387 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.10 | 1777976489 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.8 | 1777307791 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Advanced Cluster Security for Kubernetes 4.9 | 1777986630 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.8 | 1776784286 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Developer Hub 1.9 | 1777903262 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Discovery 2 | 1775675922 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502765 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.0 | 1783502438 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194938 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784194574 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784126822 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Edge Manager 1.1 | 1784127736 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467029 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1780467147 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1779189627 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778473763 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 3.3 | 1778666987 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | 1782276534 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | 1782157414 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | 1782127091 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | 1779262817 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | 1778615276 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | 1783306715 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 1778517109 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 1782240573 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 1782240332 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 1782269794 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 1777459211 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 1779874891 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 1779874967 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 1782259588 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1779256322 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1779249920 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1780503846 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 1782171676 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1778645008 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1779863939 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 1781688743 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 1779266006 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667125 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783666755 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784054598 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055387 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055726 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667517 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667577 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667611 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055020 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667641 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055586 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667790 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667859 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667875 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667869 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783667877 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055576 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055244 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1784055382 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783668266 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783668288 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | 1783669219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Pipelines 1.2 | 1779910201 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | 1776202125 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 2.6 | 1776191302 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3 | 1776151124 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3 | 1776151272 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1776151106 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.1 | 1776151270 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1776155669 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.2 | 1776149682 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1776151134 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Service Mesh 3.3 | 1776151277 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.10 | 1776736910 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.12 | 1775253092 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.15 | 1775169219 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.16 | 1779204086 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.17 | 1779922205 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Quay 3.9 | 1775169218 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1781032495 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Satellite 6.18 | 1780105179 ≤ 𝑥 < * | ADP |
Debian Releases
Common Weakness Enumeration
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object AttributesThe software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Vulnerability Media Exposure
References