Loading story…
Immutable.js disclosed and patched CVE-2026-59880, a high-severity algorithmic complexity denial-of-service flaw in Immutable.Map and Immutable.Set that lets attackers drive excessive CPU usage by supplying many keys with the same 32-bit hash. In affected versions before 4.3.9 and 5.1.8, colliding keys were placed into HashCollisionNode buckets that were scanned linearly during inserts and lookups, enabling remote hash-flooding through attacker-controlled objects passed into common code paths such as Immutable.Map(obj), Immutable.fromJS(obj), merge, and mergeDeep.
The fix, released in Immutable.js 4.3.9 and 5.1.8, changes collision handling by adding a per-process seeded secondary hash used internally to index large collision buckets while preserving the library's public deterministic hash() behavior. Project commits and release notes say the update prevents the prior degradation toward near-O(n²) behavior, includes tests covering thousands of crafted colliding keys such as "Aa"/"BB" families, merge operations, transient and persistent maps, sets, and custom objects with identical hashCode() values, and addresses the issue tracked as GHSA-xvcm-6775-5m9r and CWE-407.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-59880 was publicly disclosed as a high-severity algorithmic complexity denial-of-service vulnerability in Immutable.js affecting Immutable.Map and Immutable.Set before versions 4.3.9 and 5.1.8. The disclosure states that colliding 32-bit hashes could force linear scans and disproportionate CPU consumption during insertion and lookup.
Immutable.js released version 5.1.8, which fixes the large hash-collision bucket indexing issue in Map and another security issue in List handling. The release notes identify GHSA-xvcm-6775-5m9r among the addressed advisories.
Immutable.js released version 4.3.9, which fixes the hash-collision bucket lookup issue in Map along with another security issue in List handling. The release notes state that the update addresses GitHub Security Advisories including GHSA-xvcm-6775-5m9r.
Immutable.js published security-relevant code changes that mitigate hash-flooding denial-of-service risk in Map and Set collision handling by indexing large hash-collision buckets with a secondary internal hash. The change was published in commits 3dd7e5655012597a41873e328bf9142a8901527b and e51d49fc612ded5ec4dfb94ff294d22074269b0f.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-41907`** was disclosed in the widely used `uuid` npm package, affecting versions prior to **`14.0.0`**. The flaw stems from missing bounds checks in the `v3`, `v5`, and `v6` functions when callers supply their own output buffer, allowing out-of-range writes when a buffer is too small or an offset is too large. The issue can cause silent partial writes into caller-provided buffers and is mapped to **`CWE-787`** and **`CWE-823`**; the disclosure is also referenced in GitHub advisory **`GHSA-w5hq-g745-h8pq`**. Maintainers fixed the issue in **`uuid 14.0.0`**, with backported patches released in **`13.0.1`**, **`12.0.1`**, and **`11.1.1`** for legacy deployments. Organizations that cannot upgrade immediately were advised to add explicit bounds validation before invoking the affected functions, ensuring `offset + 16` does not exceed the destination buffer length, and to use static analysis tools such as **Semgrep** or **ESLint** to identify code paths where `v3`, `v5`, or `v6` are called with caller-controlled `Buffer` or `Uint8Array` targets.
Jun 29, 2026
A high-severity denial-of-service vulnerability in the Node.js library **Shescape** allows a remote unauthenticated attacker to exhaust CPU resources and halt application processing by sending crafted input to the library's `compose()` function. The flaw, tracked as **`GHSA-gm3r-q2wp-hw87`**, is caused by quadratic-time behavior in the library's default flag-protection logic, where repeated array copying and string joining inside a loop can be abused with repeated null-byte and hyphen sequences to block the single-threaded Node.js event loop. The issue is classified under **`CWE-407`** and **`CWE-400`** and carries a **CVSS v4.0 score of 8.7**. The bug fits the broader **Endpoint Denial of Service** technique documented by MITRE ATT&CK as **`T1499`**, in which attackers degrade or prevent service availability by exhausting host or application resources rather than saturating network bandwidth. In this case, the attack targets the application stack directly, causing total service disruption through algorithmic complexity and CPU exhaustion. Maintainers fixed the issue by replacing the repeated copy-and-join loop with an index-based linear scan, and users are advised to upgrade to **Shescape 2.1.14** or **3.0.1**.
Jul 25, 2026
Node.js released security updates for supported 20.x, 22.x, 24.x, and 25.x branches to fix **two high-severity**, **five medium-severity**, and **two low-severity** vulnerabilities, with patched versions issued as `v20.20.2`, `v22.22.2`, `v24.14.1`, and `v25.8.2`. The most serious bug, `CVE-2026-21637`, was an incomplete fix in TLS `SNICallback` handling that could be triggered remotely to cause an uncaught exception and crash affected processes. A second high-severity issue, `CVE-2026-21710`, allowed specially crafted HTTP requests using a `__proto__` header name to trigger a denial of service when applications accessed `req.headersDistinct`. The release also addressed Permission Model bypasses, a native crash in URL formatting, a timing side-channel in HMAC verification, an HTTP/2 flow-control memory leak that could lead to memory exhaustion, and a V8 **HashDoS** weakness; Node.js also updated the `undici` dependency on 22.x, 24.x, and 25.x to remediate public vulnerabilities. Debian published a corresponding `nodejs` security update, and the Canadian Centre for Cyber Security urged administrators to review vendor guidance and apply the patched releases, with internet-facing TLS servers identified as the highest-priority systems for remediation.
Jul 29, 2026