AIKIDO-2026-428611

TL;DR

Affected versions of the immutable package store Map and Set keys that share the same 32-bit hash in a linearly scanned collision bucket. The string hash is public and deterministic (JVM-style polynomial: (31 * hashed + charCode) | 0), so an attacker who controls inserted keys can precompute many distinct strings that all collide — for example, 40 characters yield more than one million colliding keys. Each insert or lookup then degrades from amortized O(1) to O(n), and building or reading the whole structure becomes O(n²). A small attacker-shaped payload can therefore consume disproportionate CPU; on a single-threaded runtime such as Node.js this stalls the event loop and denies service. Common patterns such as Immutable.Map(req.body), Immutable.fromJS(req.body), or state.merge(userObject) are affected when object keys come from untrusted input.