---
title: "immer security advisories"
description: "3 known security advisories for immer, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/immer/security
lang: en
---

[Packages](https://inlinr.com/packages)

# immer

11.2.9 · 22 Oct 2026 MIT 89.4M / week [Repository](https://github.com/immerjs/immer) [Homepage](https://github.com/immerjs/immer#readme) [npm](https://www.npmjs.com/package/immer) [Atom feed](https://inlinr.com/packages/feed/immer)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                               |
| ---- | ------ | ----------------------------------------------------------------------------- |
|      | 11.2.9 | No known advisory                                                             |
|      | 9.0.21 | 5 open advisories, worst critical  · last release Mar 2023, no longer updated |

- Critical  
[Prototype Pollution in immer](https://inlinr.com/advisories/GHSA-33f9-j839-rf8h)GHSA-33f9-j839-rf8h · 2 Sep 2021  
fixed in 9.0.6
- High  
[Prototype Pollution in immer](https://inlinr.com/advisories/GHSA-c36v-fmgq-m8hx)GHSA-c36v-fmgq-m8hx · 7 Sep 2021  
fixed in 9.0.6
- High  
[Prototype Pollution in immer](https://inlinr.com/advisories/GHSA-9qmh-276g-x5pj)GHSA-9qmh-276g-x5pj · 20 Jan 2021  
fixed in 8.0.1

### Quality and security signals

What [npm](https://www.npmjs.com/package/immer) and [deps.dev](https://deps.dev/npm/immer) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.