{"schemaVersion":3,"id":"CVE-2026-59880","aliases":["UBUNTU-CVE-2026-59880","DEBIAN-CVE-2026-59880","CGA-38jp-crj3-5465","CGA-538h-3m62-6q52","CGA-5jj6-885g-rgwp","CGA-6x52-hwc5-7mg6","CGA-73hp-q98w-cv42","CGA-9354-6f34-256v","CGA-9h5f-w6rw-2gg3","CGA-fcqw-6p5p-cp95","CGA-hh76-6m8p-8rw7","CGA-jv7j-9xvf-3rjv","CGA-r5x6-p4v3-qf75","CGA-v5p9-v359-6c2q","CGA-v7p5-4xqg-xgvq","CGA-v7x7-2prc-jfw6","CGA-xx8h-f835-5frj","GHSA-xvcm-6775-5m9r","CGA-23cx-pwrx-43c5","CGA-2929-4r98-2396","CGA-2mmf-8w3g-gx87","CGA-2vw7-r48v-jcx9","CGA-37mr-8h92-29rf","CGA-3c7w-g427-3hrp","CGA-3g52-3rv8-4ffv","CGA-3r4h-fm4g-mm4m","CGA-44cc-8rg8-x7hq","CGA-47fr-5rc2-x36q","CGA-48g3-j77h-x24c","CGA-548q-g8px-88g9","CGA-54qv-w3xf-vj35","CGA-585h-x84r-8w3v","CGA-587x-m2mg-455p","CGA-5gm8-3qg6-375p","CGA-5pj2-9phr-c5p5","CGA-63qh-8x8f-c3v3","CGA-646p-5hxv-fp7x","CGA-65xc-5mfm-34wg","CGA-66x3-fq35-jx3c","CGA-6g4g-2fmj-46p3","CGA-6jc2-95hh-c698","CGA-7f7h-fjq3-9hm2","CGA-7h72-qqpw-cx25","CGA-7h96-w6mw-w63r","CGA-7qvm-3vq3-wm72","CGA-7xj6-hvw4-5f4q","CGA-7xrh-28j8-76w2","CGA-83xj-j6j3-4934","CGA-842c-qxcg-x2wc","CGA-86qc-q2j2-52rc","CGA-8885-523j-wwf9","CGA-8hm6-x2r5-h88h","CGA-8w8c-r392-h263","CGA-92vp-566q-ppvv","CGA-97wj-mpgf-37cw","CGA-9j9c-27mg-92pg","CGA-9pgq-7w9x-4cf3","CGA-9wvp-2mfh-h6wq","CGA-c2q6-876g-56p8","CGA-c395-3762-566m","CGA-c46p-6v8m-r539","CGA-cmx9-w3h7-w4mq","CGA-cqmf-rwfr-2wh4","CGA-cvr9-9m47-2m3m","CGA-f22h-6qgc-5xqp","CGA-f25h-98q5-9p37","CGA-f45w-h8mr-5vf7","CGA-ff3c-cw89-gvmf","CGA-fj7v-6mj5-89r9","CGA-fm34-prh7-6q67","CGA-fv28-x94g-j979","CGA-fxjp-9mhc-3ffq","CGA-g24g-vpr4-96gg","CGA-g377-4rwx-frh4","CGA-g697-w4j5-jxq3","CGA-g77c-62pc-3qgm","CGA-g85j-q7v9-g5hj","CGA-gj6q-g4mh-c63x","CGA-h342-cxx3-4qm9","CGA-hjmg-84wj-5x99","CGA-j48m-cjr2-5p8h","CGA-jhh9-m2gv-q4rg","CGA-jhqc-r3gq-fcrh","CGA-jpp2-j484-68vp","CGA-jrf4-9qv3-f6wg","CGA-jwmc-h8rg-893m","CGA-m2mf-7hwx-mv4c","CGA-m2q8-7q9q-j6xv","CGA-m696-fjrw-rr7h","CGA-m8rj-f46f-hx9f","CGA-m934-m7pq-w483","CGA-m9hr-mhf3-x55p","CGA-mm69-qjrw-8cxr","CGA-p9vv-4pf6-p95j","CGA-pj6h-x6q9-r24v","CGA-pp24-q8hp-73j4","CGA-pph5-4jrf-wg9h","CGA-prx2-qqq2-8wvq","CGA-pxgg-rg42-8hwm","CGA-q8gf-h384-gmh5","CGA-qrg6-qj2c-pqrc","CGA-r2fv-j5cq-h3g2","CGA-r5gv-qj8c-jp4x","CGA-rcxq-2v5c-4cww","CGA-rfxg-w98r-rh7v","CGA-rgqc-gw9x-x6jh","CGA-rmfh-46m5-r882","CGA-rqgv-h6qf-w684","CGA-rx6p-cc3m-xwrg","CGA-vh78-w22m-p7ch","CGA-vjcp-pp6g-3j83","CGA-vjv4-5qr3-43gq","CGA-vqvh-vfm5-5h49","CGA-vr98-93q4-mg63","CGA-vrvp-6293-fgvx","CGA-w24r-pprh-f4g7","CGA-w3r5-x842-4rj2","CGA-w49g-4ggw-625h","CGA-x52m-48vm-767r","CGA-x62w-hmrp-7r29","CGA-xj64-6mm5-3394","CGA-xwv7-rpw8-7pvh"],"status":"published","duplicateOf":null,"title":null,"description":"Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.","dates":{"published":"2026-07-08T15:44:23.414Z","modified":"2026-07-08T16:13:46.106Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.7,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00665,"percentile":0.50928,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.09699999999999995,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00568},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00665,"percentile":0.50928}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00665,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00665,"percentile":0.50928}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_IMMUTABLE-JS_IMMUTABLE-JS","name":"Immutable Js","source":"github","url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-407","name":"Inefficient Algorithmic Complexity","description":"An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/407.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.11","name":"arangodb-3.11","label":"arangodb-3.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.11","purlType":"apk","versions":[{"text":"< 3.11.14.5-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.14.5-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"arangodb-3.12","name":"arangodb-3.12","label":"arangodb-3.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.12","purlType":"apk","versions":[{"text":"< 3.12.9.4-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.12.9.4-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"argo-workflows-ui-4.0","name":"argo-workflows-ui-4.0","label":"argo-workflows-ui-4.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/argo-workflows-ui-4.0","purlType":"apk","versions":[{"text":"< 4.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.11-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2025.12","name":"authentik-2025.12","label":"authentik-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2025.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.2","name":"authentik-2026.2","label":"authentik-2026.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.2","purlType":"apk","versions":[{"text":"< 2026.2.6-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.2.6-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-2026.5","name":"authentik-2026.5","label":"authentik-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.6-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 2026.5.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.6-r4 | < 2026.5.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2025.12","name":"authentik-fips-2025.12","label":"authentik-fips-2025.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2025.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"authentik-fips-2026.5","name":"authentik-fips-2026.5","label":"authentik-fips-2026.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/authentik-fips-2026.5","purlType":"apk","versions":[{"text":"< 2026.5.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2026.5.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"< 18.11.12-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.11.12-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.3","name":"gitlab-rails-ce-fips-19.3","label":"gitlab-rails-ce-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-ui","name":"keep-ui","label":"keep-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-ui","purlType":"apk","versions":[{"text":"< 0.54.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.54.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keep-ui-fips","name":"keep-ui-fips","label":"keep-ui-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keep-ui-fips","purlType":"apk","versions":[{"text":"< 0.54.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.54.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-34","name":"nextcloud-server-34","label":"nextcloud-server-34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-34","purlType":"apk","versions":[{"text":"< 34.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 34.0.2-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-api-ui","name":"rancher-api-ui","label":"rancher-api-ui","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-api-ui","purlType":"apk","versions":[{"text":"< 1.2.3-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.3-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.5-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.5-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"argo-workflows-ui-4.0","name":"argo-workflows-ui-4.0","label":"argo-workflows-ui-4.0","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/argo-workflows-ui-4.0","purlType":"apk","versions":[{"text":"< 4.0.11-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.11-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.7-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"rancher-api-ui","name":"rancher-api-ui","label":"rancher-api-ui","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/rancher-api-ui","purlType":"apk","versions":[{"text":"< 1.2.3-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.3-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.5-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.5-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"debian","product":"node-immutable","name":"node-immutable","label":"node-immutable","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-immutable","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.3.9-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.3.9-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-immutable","name":"node-immutable","label":"node-immutable","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-immutable","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"immutable-js","product":"immutable","name":"immutable","label":"immutable","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0, < 5.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.9 | ≥ 5.0.0, < 5.1.8","eol":null,"hubHref":"/vendor/immutable-js/immutable"},{"vendor":"immutable-js","product":"immutable-js","name":"immutable-js","label":"immutable-js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.1.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.3.9 | ≥ 5.0.0-beta.1, < 5.1.8","eol":null,"hubHref":"/vendor/immutable-js/immutable-js"},{"vendor":"Npm","product":"immutable","name":"immutable","label":"immutable","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/immutable","purlType":"npm","versions":[{"text":"≥ 4.0.0-beta.1, < 4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-beta.1, < 5.1.8","noFixRecorded":false,"fixedIn":null},{"text":"< 3.8.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.0.0-beta.1, < 4.3.9 | ≥ 5.0.0-beta.1, < 5.1.8 | < 3.8.4","eol":null,"hubHref":null}],"affectedCount":50,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r","label":"github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b","label":"github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f","label":"github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","label":"github.com/immutable-js/immutable-js/releases/tag/v4.3.9","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","label":"github.com/immutable-js/immutable-js/releases/tag/v5.1.8","hostname":"github.com","tags":["X Refsource MISC","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-59880","label":"ubuntu.com/security/CVE-2026-59880","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59880","label":"www.cve.org/CVERecord?id=CVE-2026-59880","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59880","label":"security-tracker.debian.org/tracker/CVE-2026-59880","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59880.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59880.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59880","label":"nvd.nist.gov/vuln/detail/CVE-2026-59880","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/immutable-js/immutable-js","label":"github.com/immutable-js/immutable-js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v3.8.4","label":"github.com/immutable-js/immutable-js/releases/tag/v3.8.4","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-36JV-9G92-VQ8V"]},"timeline":[{"kind":"published","date":"2026-07-08T15:44:23.414Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-08T16:13:46.106Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T17:03:30.428Z","stale":false,"partial":false}}