Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7267351 advisory.

  - Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and     5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(),     Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
    (CVE-2026-29063)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and     5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(),     Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
    (CVE-2026-29063)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and
    5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(),
    Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
    (CVE-2026-29063)

ID	Name	Product	Family	Severity
303559	IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.4 (7267351)	Nessus	Web Servers	high
301405	Linux Distros Unpatched Vulnerability : CVE-2026-29063	Nessus	Misc.	high
438373	SCA: security update for immutable (GHSA-wf6x-7x77-mvgw)	Tenable Cloud Security	SCA Checks	high
438373	SCA: security update for immutable (GHSA-wf6x-7x77-mvgw)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-29063

high

Tenable Plugins

high

high

high

high