Prototype Pollution In node-immutable
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | - | ||
 npm | 4.3.8, 5.1.5, 3.8.3 | ||
debian 11 | - | ||
debian 14 | 4.3.8-1 | ||
debian 13 | - | ||
 rpm rhel10 | - | - | |
rpm rhel9 | - | - | |
rpm rhel9 | - | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4. 5. 6. 7. 8.