Hi,

The following vulnerabilities were published for node-immutable.

CVE-2026-59879[0]:
| Immutable.js provides many Persistent Immutable data structures.
| Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn,
| List#updateIn, and the functional set, setIn, and updateIn mishandle
| an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in
| src/List.js, causing an empty List to enter an uncatchable infinite
| loop, a populated List to allocate without bound until process
| abort, or setSize to silently wrap large values. This issue is fixed
| in versions 4.3.9 and 5.1.8.


CVE-2026-59880[1]:
| Immutable.js provides many Persistent Immutable data structures.
| Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys
| that share the same 32-bit hash in a HashCollisionNode collision
| bucket that is scanned linearly, allowing an attacker who controls
| keys inserted into a Map, such as through Immutable.Map(obj),
| Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to
| craft many colliding keys and degrade insertion and lookup to
| consume disproportionate CPU. This issue is fixed in versions 4.3.9
| and 5.1.8.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-59879
https://www.cve.org/CVERecord?id=CVE-2026-59879
[1] https://security-tracker.debian.org/tracker/CVE-2026-59880
https://www.cve.org/CVERecord?id=CVE-2026-59880

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1141821 in node-immutable reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-immutable/-/commit/f04d85c496d3f9ba52959fb06422b8b40746944e

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1141821

Hello,

Bug #1141821 in node-immutable reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-immutable/-/commit/f04d85c496d3f9ba52959fb06422b8b40746944e

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1141821

We believe that the bug you reported is fixed in the latest version of
node-immutable, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141821@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-immutable package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 18 Aug 2026 11:37:49 +0200
Source: node-immutable
Architecture: source
Version: 4.3.9-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1141821
Changes:
 node-immutable (4.3.9-1) unstable; urgency=medium
 .
   * Team upload
   * Declare compliance with policy 4.7.4
   * Drop "Priority: optional"
   * New upstream version (Closes: #1141821, CVE-2026-59879, CVE-2026-59880)
Checksums-Sha1:
 94aa948b73c8615ec8b6c8d31113cdbe3b7f585d 2265 node-immutable_4.3.9-1.dsc
 493e81d01ea81921d48395b59fe9184381058f31 994343 node-immutable_4.3.9.orig.tar.gz
 b901095aa3043ea7e740ddfee6de6b1d3f241154 73720 node-immutable_4.3.9-1.debian.tar.xz
Checksums-Sha256:
 3d226cdba3fe83a8df537ab3f77b27caba161cd2e89679056aeceb208a901d90 2265 node-immutable_4.3.9-1.dsc
 d4738b9a41a412907ca8e4ac819fcbe985750cfcb1e1c438197cd756e373b649 994343 node-immutable_4.3.9.orig.tar.gz
 4803aad87b6f54be5fe6cd99e8be21d8ea3b10c4c06fcf7f70608f31bed7461f 73720 node-immutable_4.3.9-1.debian.tar.xz
Files:
 12cb52586568e740b5a9536940c2149a 2265 javascript optional node-immutable_4.3.9-1.dsc
 a20b18fe6e3a4105d8f6ae1aa9c88b55 994343 javascript optional node-immutable_4.3.9.orig.tar.gz
 a5637e826a1803312fbb3313e3d58a73 73720 javascript optional node-immutable_4.3.9-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqEKLsACgkQ9tdMp8mZ
7um3XA//Z+6dKwa9MO+Pj6TA5jgnDQIRXSSMvzzFVKPnr9bewUoYUuAoMemr7g0V
ulNiBxc2k3S/aAcYG/B7kZdbrCHyrLdcEaIFETxp6fWzG56VQ73hfJO+t08DaS9d
piManGWLdPpYjtHEqZahGSiBO/zcktzZeM7rdoDxpuEVeROtLpoLbsNKqDJbZSDm
MMneol5X6ud0nDUoz+U7QXURv6OwCXUeVgx7I+WRs9vN6Uwg2Aag4JWYLAz9lvOn
j/VaTVfLwNsH2y7kUhMM3NGPs7My5Sb6E37Cj1+6EElWlnpzrXnyH/+Ft71Fv7fQ
ysABseoacK/jORjNh59f54iHBnxK9E4xhheIfIwWUGyBUMKCmWNLeoa49ICIim7U
1Mnf86ej5J7TX0PO16u9jlIN/KDKH3CAhHP2zWbZuI67KSuQ0UFzOoHbF6FGSWzk
4KugPdQyQoXAuZLMXFMSXnfP8rXJ1X1OBNdRU+gcWRRZzEqqiT4shv3pqjSUjuur
qFp8gI65bzbR6Dfsq8P0JlfOnpTV5Bu3ti+dlmcaV+2PU3MhwmouXmd5HhznFu43
Wv2bd+ovWJgUWLeKz7e2kJEQYrfY7PmD/OeiGRU++TZD6F9cHAiDh81s8401oqdo
rBdIZnx4MqIqP/tIQjp9miK8K249zh6EX6KP2JOWsWJm5PjJW2o=
=HJtH
-----END PGP SIGNATURE-----