CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

@0xfutbol/id (>=2.0.0, <=2.0.200), @2060.io/credo-ts-didcomm-media-sharing (>=0.0.5, <=0.1.0) +823 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0, <=1.4.1)

valibot NPM version =1.0.0, =2.0.0, =0.0.5, =0.0.4, =0.0.8, =0.0.12, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =0.1.0, =0.6.0, =0.6.6 and more Source cves: CVE-2026-59952 Source advisory: OSV:GHSA-5QJJ-4XWW-7PHC...

@0xfutbol/id (>=2.0.0, <=2.0.200), @2060.io/credo-ts-didcomm-media-sharing (>=0.0.5, <=0.1.0) +823 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0, <=1.4.1)

valibot NPM version =1.0.0, =2.0.0, =0.0.5, =0.0.4, =0.0.8, =0.0.12, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =0.1.0, =0.6.0, =0.6.6 and more Source cves: CVE-2026-59952 Source advisory: SNYK:JS-VALIBOT-18313048...