CVE-2026-59880 is a Hash Collision Algorithmic Complexity Denial-of-Service vulnerability affecting Immutable.js.
Discovered & responsibly disclosed by nvth. An attacker controlling JSON object keys
can force all keys into one HashCollisionNode bucket, burning CPU via O(n²) linear scans.
Affects immutable < 5.1.7. Patched in 4.3.9 and 5.1.8.
New vulnerability research drops as soon as the disclosure embargo lifts.
Follow nvth on GitHub for updates.