Repository navigation
[vuln-sentinel] HIGH npm immutable: 2 known vulnerabilities #8
Description
Package: immutable (npm)
Upgrade to: 5.1.8 or later
Found in: web/package-lock.json
| Vulnerability | Severity | Installed | Fixed in | Summary | |
|---|---|---|---|---|---|
| GHSA-v56q-mh7h-f735 | HIGH | 5.1.5 | 5.1.8 | Immutable.js List 32-bit trie overflow → unrecoverable DoS |
|
| GHSA-xvcm-6775-5m9r | HIGH | 5.1.5 | 5.1.8 | Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set |
Automatic upgrade to 5.1.8 failed in
web/package-lock.json: the upgrade did not remove the vulnerable version (version constraint conflict)
Daily report: https://github.com/dennislee928/vuln-ops/blob/main/reports/2026-11-02.md
Managed by vuln-sentinel. This issue closes automatically once the vulnerable versions are gone from the default branch.
Activity