CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

@0xfutbol/id (>=2.0.0, <=2.0.200), @ack-lab/sdk (>=0.0.5, <=0.1.1) +658 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0-beta.0, <=1.4.1)

valibot NPM version =1.0.0-beta.0, =2.0.0, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.4.1, =0.10.0-rc.17 and more Source cves: CVE-2026-59952 Source advisory: GHSA-5QJJ-4XWW-7PHC...