CVE-2026-59952

Name of the Vulnerable Software and Affected Versions Valibot versions prior to 1.4.2

Description Valibot can throw a TypeError within its flatten() helper when validation issues contain object keys controlled by an attacker that collide with inherited Object.prototype properties, such as toString, valueOf, or hasOwnProperty. This occurs during record() validation; while record() filters proto, prototype, and constructor, it accepts other inherited property names. If the record key or value schema rejects such an entry, Valibot creates an issue path containing that key. When these issues are passed to the flatten() helper, the application attempts to call .push() on the inherited method instead of an error array, leading to a crash. This is not a global prototype pollution issue, but it impacts availability and error handling, potentially crashing the request path in applications that flatten validation errors for API responses.

Recommendations Update Valibot to version 1.4.2 or later.