CVE-2026-29063
Critical
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Immutable
PublishedMar 6, 2026
First seenMar 6, 2026
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- immutable-js immutable3.8.3, 4.3.7, 5.1.5, 4.3.8 or later
- immutable4.3.8, 5.1.5, 3.8.3 or later
- redhat advanced_cluster_management_for_kubernetes2.14.3, 2.15.2, 2.16.1 or later
- redhat advanced_cluster_security4.8.11, 4.9.6, 4.10.2 or later
- redhat developer_hub1.8.6, 1.9.4 or later
- redhat edge_manager1.0.3, 1.1.3 or later
- redhat multicluster_engine_for_kubernetes2.6.10, 2.7.10, 2.8.5, 2.9.3, 2.10.2, 2.11.1 or later
- redhat openshift_container_platform4.12.93, 4.13.69, 4.14.68, 4.15.66, 4.16.63, 4.17.54, 4.18.39, 4.19.32, 4.20.23, 4.21.17 or later
- redhat openshift_data_foundation4.18.25, 4.19.20, 4.20.15 or later
- redhat openshift_pipelines1.20.5 or later
- redhat quay3.9.20, 3.10.21, 3.12.16, 3.15.4, 3.16.4, 3.17.2 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2026:34342
- access.redhat.com/errata/RHSA-2026:19409
- access.redhat.com/errata/RHSA-2026:19410
- access.redhat.com/errata/RHSA-2026:6428
- access.redhat.com/errata/RHSA-2026:24473
- access.redhat.com/errata/RHSA-2026:36882
- access.redhat.com/errata/RHSA-2026:13548
- access.redhat.com/errata/RHSA-2026:13847
- access.redhat.com/errata/RHSA-2026:11070
- access.redhat.com/errata/RHSA-2026:11217
- access.redhat.com/errata/RHSA-2026:13791
- access.redhat.com/errata/RHSA-2026:13829
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| immutable-js immutable | 3.0.0 ≤ v < 3.8.3, 4.0.0 ≤ v < 4.3.7, 5.0.0 ≤ v < 5.1.5, 4.0.0 ≤ v < 4.3.8 | 3.8.3, 4.3.7, 5.1.5, 4.3.8 |
| immutablenpm | 4.0.0-rc.1 ≤ v < 4.3.8, 5.0.0 ≤ v < 5.1.5, v < 3.8.3 | 4.3.8, 5.1.5, 3.8.3 |
| redhat 3scale_api_management_platform | 2.0 | — |
| redhat advanced_cluster_management_for_kubernetes | 2.14 ≤ v < 2.14.3, 2.15 ≤ v < 2.15.2, 2.16 ≤ v < 2.16.1 | 2.14.3, 2.15.2, 2.16.1 |
| redhat advanced_cluster_security | 4.8.0 ≤ v < 4.8.11, 4.9.0 ≤ v < 4.9.6, 4.10.0 ≤ v < 4.10.2 | 4.8.11, 4.9.6, 4.10.2 |
| redhat ansible_automation_platform | 2.0 | — |
| redhat build_of_apicurio_registry | 2.0 | — |
| redhat connectivity_link | 1.0 | — |
| redhat developer_hub | 1.8.0 ≤ v < 1.8.6, 1.9.0 ≤ v < 1.9.4 | 1.8.6, 1.9.4 |
| redhat discovery | 2.0 | — |
| redhat edge_manager | 1.0 ≤ v < 1.0.3, 1.1 ≤ v < 1.1.3 | 1.0.3, 1.1.3 |
| redhat logging_subsystem_for_red_hat_openshift | No range specified | — |
| redhat migration_toolkit | 1.8 | — |
| redhat migration_toolkit_for_virtualization | 2.9.0, 2.10.0 | — |
| redhat multicluster_engine_for_kubernetes | 2.6 ≤ v < 2.6.10, 2.7 ≤ v < 2.7.10, 2.8 ≤ v < 2.8.5, 2.9 ≤ v < 2.9.3, 2.10 ≤ v < 2.10.2, 2.11 ≤ v < 2.11.1 | 2.6.10, 2.7.10, 2.8.5, 2.9.3, 2.10.2, 2.11.1 |
| redhat network_observability_operator | 1.11.0, 1.12.3 | — |
| redhat openshift_cluster_observability_operator | 1.5.3 | — |
| redhat openshift_container_platform | 4.12 ≤ v < 4.12.93, 4.13 ≤ v < 4.13.69, 4.14 ≤ v < 4.14.68, 4.15 ≤ v < 4.15.66, 4.16 ≤ v < 4.16.63, 4.17 ≤ v < 4.17.54, 4.18 ≤ v < 4.18.39, 4.19 ≤ v < 4.19.32, 4.20 ≤ v < 4.20.23, 4.21 ≤ v < 4.21.17, 4.0 | 4.12.93, 4.13.69, 4.14.68, 4.15.66, 4.16.63, 4.17.54, 4.18.39, 4.19.32, 4.20.23, 4.21.17 |
| redhat openshift_data_foundation | 4.18 ≤ v < 4.18.25, 4.19 ≤ v < 4.19.20, 4.20 ≤ v < 4.20.15, 4.17 | 4.18.25, 4.19.20, 4.20.15 |
| redhat openshift_gitops | No range specified | — |
| redhat openshift_lightspeed | No range specified | — |
| redhat openshift_pipelines | 1.20 ≤ v < 1.20.5 | 1.20.5 |
| redhat openshift_service_mesh | 2.6, 3.0, 3.1, 3.2, 3.3 | — |
| redhat openshift_virtualization | 4 | — |
| redhat quay | 3.9.0 ≤ v < 3.9.20, 3.10.0 ≤ v < 3.10.21, 3.12.0 ≤ v < 3.12.16, 3.15.0 ≤ v < 3.15.4, 3.16.0 ≤ v < 3.16.4, 3.17.0 ≤ v < 3.17.2, 3.18.0 | 3.9.20, 3.10.21, 3.12.16, 3.15.4, 3.16.4, 3.17.2 |
| redhat satellite | 6.0, 6.18 | — |
| redhat self-service_automation_portal | 2.0 | — |
| redhat enterprise_linux | 8.0, 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.