CVE-2026-59880
HighAdvisory
Published 21 Jul 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.007
- 50th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 77
- of 17,781 indexed, latest versions
- Container images
- 67
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Carried by container images the latest versions of 77 of 17,781 indexed charts deploy, on 67 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| immutablenpm | 3.7.6, 3.8.2, 4.0.0, 4.0.0-rc.14+13 more | 3.8.4, 4.3.9, 5.1.8 | 67 |
- OSV records
- GHSA-xvcm-6775-5m9r
Charts affected
77 by stars
Container images carrying it
67 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| mojaloop/ | b06d3287ea82 | immutable | 3.8.4 | 3 |
| ghcr.io/ | a4a3639899f7 | immutable | 3.8.4 | 3 |
| ethersphere/ | 0558799ca992 | immutable | 4.3.9 | 2 |
| gjeanmart/ | 926264c8f2d1 | immutable | 4.3.9 | 2 |
| gradiant/ | fbd10c017541 | immutable | 4.3.9 | 2 |
| mojaloop/ | 1abc8a7aa71c | immutable | 3.8.4 | 2 |
| mojaloop/ | fb71d233c742 | immutable | 3.8.4 | 2 |
| mojaloop/ | 1e0d24d28512 | immutable | 5.1.8 | 2 |
| mojaloop/ | 265102a049d6 | immutable | 5.1.8 | 2 |
| mojaloop/ | def4bf273721 | immutable | 4.3.9 | 2 |
| mojaloop/ | 12af60892c75 | immutable | 5.1.8 | 2 |
| requarks/ | 68f0d1848261 | immutable | 3.8.4 | 2 |
| ghcr.io/ | acb40032ad4b | immutable | 4.3.9 | 2 |
| 0hlov3/ | 50f874ec096b | immutable | 4.3.9 | 1 |
| assistiot/ | f11d82defc70 | immutable | 3.8.4 | 1 |
| countly/ | f4cc7447c4f5 | immutable | 4.3.9 | 1 |
| countly/ | e3c238248f99 | immutable | 4.3.9 | 1 |
| countly/ | 2acbc11499b6 | immutable | 4.3.9 | 1 |
| dessalines/ | ee4c620d8e93 | immutable | 4.3.9 | 1 |
| directus/ | e3c8bb975350 | immutable | 4.3.9 | 1 |
| electerious/ | 5e7173fa321c | immutable | 3.8.4 | 1 |
| ethereumoptimism/ | e07968a0e686 | immutable | 4.3.9 | 1 |
| ethersphere/ | 7624f11a72ad | immutable | 4.3.9 | 1 |
| ethersphere/ | 513154aab230 | immutable | 4.3.9 | 1 |
| factly/ | 742355964b0e | immutable | 4.3.9 | 1 |
| fiware/ | a1b6ed4ae84f | immutable | 4.3.9 | 1 |
| helga09/ | 7999bc8b77c0 | immutable | 4.3.9 | 1 |
| ibmcom/ | ed5505e5c7ec | immutable | 3.8.4 | 1 |
| jayfong/ | 163e5d621910 | immutable | 3.8.4 | 1 |
| joplin/ | 52af57880c0e | immutable | 4.3.9 | 1 |
| joplin/ | b87564ef34e9 | immutable | 4.3.9 | 1 |
| kobotoolbox/ | bcacc01bccd4 | immutable | 3.8.4 | 1 |
| kyleslugg/ | ba8c36dfdfbd | immutable | 4.3.9 | 1 |
| langgenius/ | a2a294743634 | immutable | 4.3.9 | 1 |
| langgenius/ | c306ac577912 | immutable | 5.1.8 | 1 |
| langgenius/ | d64914ff0d6d | immutable | 4.3.9 | 1 |
| lissy93/ | 1991f7be5ed0 | immutable | 4.3.9 | 1 |
| misskey/ | e08b7c478093 | immutable | 4.3.9 | 1 |
| ohmyform/ | afe53f4acdb1 | immutable | 4.3.9 | 1 |
| opea/ | 2bee4eb66f3e | immutable | 4.3.9 | 1 |
| openmined/ | d11524a3854a | immutable | 4.3.9 | 1 |
| polonel/ | 0cf6513f6fe3 | immutable | 4.3.9 | 1 |
| requarks/ | 8b5865a7386c | immutable | 3.8.4 | 1 |
| solidproject/ | ccc4acb7e9a1 | immutable | 4.3.9 | 1 |
| supabase/ | 26d8070c55e9 | immutable | 4.3.9 | 1 |
| thecodingmachine/ | 5bdab56da2fa | immutable | 4.3.9 | 1 |
| unitycatalog/ | 3a688197b218 | immutable | 4.3.9 | 1 |
| vlebediantsev/ | 945675fd2636 | immutable | 4.3.9 | 1 |
| wettyoss/ | 7423b3d40ba2 | immutable | 5.1.8 | 1 |
| yidadaa/ | eaaa469ddeeb | immutable | 4.3.9 | 1 |