Skip to content
fr Sign in
8.7 High

CVE-2026-29063 Immutable.js provides many Persistent Immutable data structures

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Affected products and versions

Product Affected versions Fixed in
Migration Toolkit for Virtualization 2.1 1779139872 earliest → < 1779139872 1779139872
Migration Toolkit for Virtualization 2.9 1778927462 earliest → < 1778927462 1778927462
Network Observability (NETOBSERV) 1.11.2 1774431617 earliest → < 1774431617 1774431617
Network Observability (NETOBSERV) 1.12.0 1780920979 earliest → < 1780920979 1780920979
Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126 earliest → < 1776927126 1776927126
Red Hat Advanced Cluster Management for Kubernetes 2.16 1777559387 earliest → < 1777559387 1777559387
Red Hat Advanced Cluster Security for Kubernetes 4.10 1777976489 earliest → < 1777976489 1777976489
Red Hat Advanced Cluster Security for Kubernetes 4.8 1777307791 earliest → < 1777307791 1777307791
Red Hat Advanced Cluster Security for Kubernetes 4.9 1777986630 earliest → < 1777986630 1777986630
Show the 81 other branches
Product Affected versions Fixed in
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Red Hat Discovery 2 1775675922 earliest → < 1775675922 1775675922
Red Hat OpenShift AI 2.25 1780467147 earliest → < 1780467147 1780467147
Red Hat OpenShift AI 3.3 1778666987 earliest → < 1778666987 1778666987
Red Hat OpenShift Container Platform 4.16 1783306715 earliest → < 1783306715 1783306715
Red Hat OpenShift Container Platform 4.17 1782269794 earliest → < 1782269794 1782269794
Red Hat OpenShift Container Platform 4.18 1782259588 earliest → < 1782259588 1782259588
Red Hat OpenShift Container Platform 4.19 1782171676 earliest → < 1782171676 1782171676
Red Hat OpenShift Container Platform 4.20 1781688743 earliest → < 1781688743 1781688743
Red Hat OpenShift Container Platform 4.21 1779266006 earliest → < 1779266006 1779266006
Red Hat OpenShift Pipelines 1.2 1779910201 earliest → < 1779910201 1779910201
Red Hat OpenShift Service Mesh 2.6 1776191302 earliest → < 1776191302 1776191302
Red Hat OpenShift Service Mesh 3.0 1776151272 earliest → < 1776151272 1776151272
Red Hat OpenShift Service Mesh 3.1 1776151270 earliest → < 1776151270 1776151270
Red Hat OpenShift Service Mesh 3.2 1776149682 earliest → < 1776149682 1776149682
Red Hat OpenShift Service Mesh 3.3 1776151277 earliest → < 1776151277 1776151277
Red Hat Quay 3.12 1775253092 earliest → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1779204086 earliest → < 1779204086 1779204086
Red Hat Quay 3.17 1779922205 earliest → < 1779922205 1779922205
Red Hat Quay 3.1 1776736910 earliest → < 1776736910 1776736910
Red Hat Quay 3.9 1775169218 earliest → < 1775169218 1775169218
Red Hat Satellite 6.18 1780105179 earliest → < 1780105179 1780105179
multicluster engine for Kubernetes 2.10 1777128790 earliest → < 1777128790 1777128790
multicluster engine for Kubernetes 2.11 1777559392 earliest → < 1777559392 1777559392
multicluster engine for Kubernetes 2.6 1776223790 earliest → < 1776223790 1776223790
multicluster engine for Kubernetes 2.7 1777306226 earliest → < 1777306226 1777306226
multicluster engine for Kubernetes 2.8 1775116156 earliest → < 1775116156 1775116156
multicluster engine for Kubernetes 2.9 1777301444 earliest → < 1777301444 1777301444
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Containers Versions not published
Node HealthCheck Operator Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Satellite 6 Versions not published
Self-service automation portal 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Enterprise Linux 8 Versions not published
immutable-js 5.1 earliest → < 5.1.5 5.1.5
immutable-js 4.3 earliest → < 4.3.7 4.3.7
immutable-js 3.8 earliest → < 3.8.3 3.8.3
Red Hat Quay 3.10 1776736910 earliest → < 1776736910 1776736910
Cluster Observability Operator 1.5.0 1782839996 earliest → < 1782839996 1782839996
Red Hat OpenShift Container Platform 4.14 1782157414 earliest → < 1782157414 1782157414
Red Hat OpenShift Container Platform 4.15 1782127091 earliest → < 1782127091 1782127091
Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 earliest → < 1783451729 1783451729
Red Hat Edge Manager 1.0 1783502438 earliest → < 1783502438 1783502438
Red Hat OpenShift Container Platform 4.12 1782276534 earliest → < 1782276534 1782276534
Red Hat OpenShift Service Mesh 3 1776151272 earliest → < 1776151272 1776151272
Network Observability (NETOBSERV) 1.12.1 1780920979 earliest → < 1780920979 1780920979
Red Hat Edge Manager 1.1 1784127736 earliest → < 1784127736 1784127736
Red Hat Openshift Data Foundation 4.20 1783669219 earliest → < 1783669219 1783669219
multicluster engine for Kubernetes 2.1 1777128790 earliest → < 1777128790 1777128790
Red Hat Advanced Cluster Security 4.8 1777307791 earliest → < 1777307791 1777307791
Red Hat Advanced Cluster Security 4.9 1777986630 earliest → < 1777986630 1777986630
Red Hat OpenShift Container Platform 4.2 1781688743 earliest → < 1781688743 1781688743
Red Hat Openshift Data Foundation 4.2 1783669219 earliest → < 1783669219 1783669219
multicluster engine for Kubernetes 2.11.0 1777559392 earliest → < 1777559392 1777559392
Red Hat Migration Toolkit 1.8 1783690532 earliest → < 1783690532 1783690532
Red Hat Openshift Data Foundation 4.18 1783677533 earliest → < 1783677533 1783677533
Red Hat Openshift Data Foundation 4.19 1783685375 earliest → < 1783685375 1783685375
Red Hat OpenShift Container Platform 4.13 1784055834 earliest → < 1784055834 1784055834
multicluster engine for Kubernetes 2.9.0 1777301444 earliest → < 1777301444 1777301444
Network Observability (NETOBSERV) 1.11.1 1774431617 earliest → < 1774431617 1774431617
Red Hat Advanced Cluster Management for Kubernetes 2.16.0 1777559387 earliest → < 1777559387 1777559387
Network Observability (NETOBSERV) 1.11.0 1774431617 earliest → < 1774431617 1774431617
Red Hat Migration Toolkit for Containers 1.8 1783690532 earliest → < 1783690532 1783690532
Network Observability (NETOBSERV) 1.12.2 1780920979 earliest → < 1780920979 1780920979

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Migration Toolkit for Virtualization 2.1

The 8 CVEs of Migration Toolkit for Virtualization 2.1 →
CVE-2026-4800 The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same… 8.1 High CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace… 7.5 High CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the… 8.7 High CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing… 9.1 Critical
Track this CVE