immutable transitive dependency needs updating to 4.3.9 (CVE-2026-29063, CVE-2026-59879, CVE-2026-59880)

Author: craigedmundsCreated Aug 20, 2026Updated Aug 20, 2026

The package-lock.json at v4.5.2 resolves immutable to 4.3.7, which is vulnerable to three CVEs — all fixed in 4.3.9:

CVE	Severity	Description	Fixed in
CVE-2026-29063	Critical (CVSS 9.8)	Prototype pollution in `mergeDeep`, `merge`, `Map.toJS`, `Map.toObject`	4.3.8
CVE-2026-59879	High (CVSS 7.5)	Integer overflow in `List.setListBounds` — large index values (2³⁰–2³¹) cause infinite loops or unbounded memory allocation	4.3.9
CVE-2026-59880	High (CVSS 7.5)	Hash-collision DoS in `Map`/`Set` — attacker-controlled keys degrade to linear scanning	4.3.9

Both sass and sass-embedded declare "immutable": "^4.0.0", so bumping the resolved version to 4.3.9 satisfies the existing constraints with no breaking change to any direct dependency. immutable is a leaf package with no dependencies of its own, so the diff to package-lock.json is minimal:

Patch

diff

--- a/package-lock.json
+++ b/package-lock.json
@@ node_modules/immutable @@
-      "version": "4.3.7",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.7.tgz",
-      "integrity": "sha512-1hqclzwYwjRDFLjcFxOM5AYkkG0rpFPpr1RLPMEuGczoS7YA8gLhy8SWXYRAA/XwfEHpfo3cw5JGioS32fnMRw=="
+      "version": "4.3.9",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-4.3.9.tgz",
+      "integrity": "sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==",
+      "license": "MIT"

To reproduce (npm audit):

bash

git clone --branch v4.5.2 https://github.com/jackyzha0/quartz
cd quartz
npm ci
npm audit

Happy to raise a PR updating the lock file if that would be helpful.

Source: jackyzha0/quartz

View original on GitHub View discussion on GitHub