不可变传递依赖需要更新为 4.3.9 (CVE-2026-29063、CVE-2026-59879、CVE-2026-59880)
作者: craigedmunds创建于 2026年8月20日更新于 2026年8月20日
The package-lock.json at v4.5.2 resolves immutable to 4.3.7, which is vulnerable to three CVEs — all fixed in 4.3.9:
| CVE | Severity | Description | Fixed in |
|---|---|---|---|
| CVE-2026-29063 | Critical (CVSS 9.8) | Prototype pollution in mergeDeep, merge, Map.toJS, Map.toObject |
4.3.8 |
| CVE-2026-59879 | High (CVSS 7.5) | Integer overflow in List.setListBounds — large index values (2³⁰–2³¹) cause infinite loops or unbounded memory allocation |
4.3.9 |
| CVE-2026-59880 | High (CVSS 7.5) | Hash-collision DoS in Map/Set — attacker-controlled keys degrade to linear scanning |
4.3.9 |
Both sass and sass-embedded declare "immutable": "^4.0.0", so bumping the resolved version to 4.3.9 satisfies the existing constraints with no breaking change to any direct dependency. immutable is a leaf package with no dependencies of its own, so the diff to package-lock.json is minimal:
内容来源: jackyzha0/quartz