CyberRota Analysis
AI-GeneratedImmutable.js versions prior to 4.3.9 and 5.1.8 are vulnerable due to a flaw in the handling of hash collisions within Immutable.Map and Immutable.Set, allowing attackers to exploit this by inserting crafted keys that lead to excessive CPU consumption during insertion and lookup operations. This vulnerability poses a significant risk to applications relying on these data structures, particularly those that process user-generated input. Developers and organizations using affected versions should prioritize upgrading to the patched releases to mitigate potential denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.
Related CVEs
Other vulnerabilities affecting the same vendor(s)