GHSA-WF6X-7X77-MVGW Immutable is vulnerable to Prototype Pollution

Impact What kind of vulnerability is it? Who is impacted? A Prototype Pollution is possible in immutable via the mergeDeep, mergeDeepWith, merge, Map.toJS, and Map.toObject APIs. Affected APIs | API | Notes | | --------------------------------------- |...

org.webjars.npm:browser-sync-ui (=2.27.11), org.webjars.npm:bulma (=1.0.0) +21 more potentially affected by CVE-2026-29063 via org.webjars.npm:immutable (>=3.7.6 <=5.1.3)

org.webjars.npm:immutable MAVEN version =3.7.6, =0.7.0, =0.8.3, =0.8.4 - org.webjars.npm:flux =2.1.1 - org.webjars.npm:github-com-DataTables-DataTablesSrc =2.0.5 - org.webjars.npm:github-com-codeforms-Punica-CSS-Framework =3.0.0 - org.webjars.npm:github-com-digicorp-propeller =1.3.2 -...

@0xgraph/cli (>=0.0.1 <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0 <=3.0.0) +653 more potentially affected by CVE-2026-29063 via immutable (>=4.0.0-rc.1 <=4.3.7)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing =6.0.0-A.2-8258 - @alys-chain/graph-alys-cli =0.88.0 and more Source cves: CVE-2026-29063 Source advisory: SNYK:JS-IMMUTABLE-15423650...

-graphql-codegen-client-preset-swc-test (>=2.0.1 <=2.0.2), 01-test-button (>=1.0.0 <=1.0.2) +10983 more potentially affected by CVE-2026-29063 via immutable (>=3.0.1 <=3.8.2)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-29063 Source advisory: SNYK:JS-IMMUTABLE-15423650...

@0xgraph/cli (>=0.0.1 <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0 <=3.0.0) +653 more potentially affected by CVE-2026-29063 via immutable (>=4.0.0-rc.1 <=4.3.7)

immutable NPM version =4.0.0-rc.1, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing =6.0.0-A.2-8258 - @alys-chain/graph-alys-cli =0.88.0 and more Source cves: CVE-2026-29063 Source advisory: OSV:GHSA-WF6X-7X77-MVGW...

-graphql-codegen-client-preset-swc-test (>=2.0.1 <=2.0.2), 01-test-button (>=1.0.0 <=1.0.2) +11002 more potentially affected by CVE-2026-29063 via immutable (>=2.0.17 <=3.8.2)

immutable NPM version =2.0.17, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-29063 Source advisory: OSV:GHSA-WF6X-7X77-MVGW...