[GHSA-v56q-mh7h-f735] Immutable.js List 32-bit trie overflow → unrecoverable DoS

[Ryan-Leber]

Updates

• Affected products
• CVSS v3

Comments
A patch has been added for versions 3 and 4. GHSA-v56q-mh7h-f735

[github]

Hi there @jdeniau! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟡 Changes recommended

Retain the CVSS v3 entry and use valid separate fixed-version events for each affected range.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the Immutable.js DoS advisory with patched-version and severity metadata.

Changes:

• Updates affected ranges and fixed-version metadata for versions 3, 4, and 5.
• Refreshes the modification timestamp and CVSS metadata.

File summaries

File	Description
advisories/github-reviewed/2026/07/GHSA-v56q-mh7h-f735/GHSA-v56q-mh7h-f735.json	Updates advisory metadata and affected-version ranges.

Review details

Suppressed comments (1)

advisories/github-reviewed/2026/07/GHSA-v56q-mh7h-f735/GHSA-v56q-mh7h-f735.json:15

• The PR description lists a CVSS v3 update, but this hunk removes the only CVSS_V3 score and leaves only CVSS v4. That drops the existing v3 metadata instead of updating it; retain the v3 entry and change its vector if the upstream score changed.

      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
    }

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.