CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

EUVD-2026-50775

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952

Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...

CVE-2026-59952

creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:24+00:00| published-proof-of-concept| https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc 2026-07-30 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrtc4apzxn25...

Valibot: record() issue paths can make flatten() throw for inherited Object property names

Summary valibot 1.4.1 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record intentionally filters proto, prototype, and constructo...

NPM: Valibot: record() issue paths can make flatten() throw for inherited Object property names

NPM: Valibot: record issue paths can make flatten throw for inherited Object property names vulnerability discovered by ? in WordPress Npm valibot versions = 1.4.1...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

GHSA-5QJJ-4XWW-7PHC Valibot: record() issue paths can make flatten() throw for inherited Object property names

Summary valibot 1.4.1 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record intentionally filters proto, prototype, and constructo...

PT-2026-64442

Name of the Vulnerable Software and Affected Versions Valibot versions prior to 1.4.2 Description Valibot can throw a TypeError within its flatten helper when validation issues contain object keys controlled by an attacker that collide with inherited Object.prototype properties, such as toString,...

Malicious code in @tanstack/valibot-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25062244509cace2232407aaa71ca13d0ca2cf2c113e8e1dd19280694a3475cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3493 Malicious code in @tanstack/valibot-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25062244509cace2232407aaa71ca13d0ca2cf2c113e8e1dd19280694a3475cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Regular Expression Denial Of Service (ReDoS)

Valibot is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient processing in the EMOJIREGEX used by the emoji action, which allows an attacker to supply a crafted input that triggers excessive CPU consumption and causes a denial of service...

CVE-2025-66020

Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJIREGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service ReDoS attack. A short, maliciously crafted string e.g., 100 characters can cause the regex engine to consume excessive CPU...

Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

Summary The EMOJIREGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service ReDoS attack. A short, maliciously crafted string e.g., 100 characters can cause the regex engine to consume excessive CPU time minutes, leading to a Denial of Service DoS for the application...

GHSA-VQPR-J7V3-HQW9 Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

Summary The EMOJIREGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service ReDoS attack. A short, maliciously crafted string e.g., 100 characters can cause the regex engine to consume excessive CPU time minutes, leading to a Denial of Service DoS for the application...

@0xfutbol/id (>=2.0.0 <=2.0.200), @0xkamal7/sui-agent (>=1.1.2 <=1.1.5) +1685 more potentially affected by CVE-2025-66020 via valibot (>=0.31.0 <=1.1.0)

valibot NPM version =0.31.0, =2.0.0, =1.1.2, =1.2.0-pre.92, =1.2.0-pre.24, =1.2.0-pre.24, =0.0.1, =0.0.1, =0.0.1, =1.2.0-pre.64, =0.0.1, =0.0.1, =0.5.9, =0.5.18, =0.0.2-beta.0, =0.1.1-beta.1, =0.2.0 and more Source cves: CVE-2025-66020 Source advisory: OSV:GHSA-VQPR-J7V3-HQW9...

EUVD-2025-199685

Valibot has a ReDoS vulnerability in EMOJIREGEX...

@0xfutbol/id (>=2.0.0 <=2.0.200), @0xkamal7/sui-agent (>=1.1.2 <=1.1.5) +1689 more potentially affected by CVE-2025-66020 via valibot (>=0.31.0-rc.4 <=1.1.0)

valibot NPM version =0.31.0-rc.4, =2.0.0, =1.1.2, =1.2.0-pre.92, =1.2.0-pre.24, =1.2.0-pre.24, =0.0.1, =0.0.1, =0.0.1, =1.2.0-pre.64, =0.0.1, =0.0.1, =0.5.9, =0.5.18, =0.0.2-beta.0, =0.1.1-beta.1, =0.2.0 and more Source cves: CVE-2025-66020 Source advisory: SNYK:JS-VALIBOT-14122017...

Regular Expression Denial of Service (ReDoS)

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the EMOJIREGEX. An attacker can cause excessive CPU consumption and disrupt application availability by...