CLSA-2026-1792473247 TuxCare security update for valibot (1 CVE)

TuxCare rebuilt valibot to address 1 CVE. Fixed in 1.2.0-tuxcare.1...

CLSA-2026-1789465861 TuxCare security update for valibot (2 CVEs)

TuxCare rebuilt valibot to address 2 CVEs. Fixed in 0.41.0-tuxcare.1...

PT-2026-99027

TuxCare rebuilt valibot to address 2 CVEs. Fixed in 0.41.0-tuxcare.1...

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

EUVD-2026-50775

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952

Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

@0x57/client (>=0.0.4, <=0.0.5), @0x57/passkey (>=0.0.0, <=0.0.6) +2311 more potentially affected by CVE-2026-59952 via valibot (>=0.3.0, <=1.4.1)

valibot NPM version =0.3.0, =0.0.4, =0.0.0, =0.0.0, =2.0.0, =1.1.2, =1.2.0-pre.92, =1.2.0-pre.24, =1.2.0-pre.24, =0.0.1, =0.0.1, =0.0.1, =1.2.0-pre.64, =0.0.1, =0.0.1, =0.0.1, =0.2.8 and more Source cves: CVE-2026-59952 Source advisory: MEND:CVE-2026-59952...

CVE-2026-59952

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952 Valibot: record() issue paths can make flatten() throw for inherited Object property names

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952: Improper Handling of Exceptional Conditions

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record...

CVE-2026-59952

creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:24+00:00| published-proof-of-concept| https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc 2026-07-30 01:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrtc4apzxn25...

NPM: Valibot: record() issue paths can make flatten() throw for inherited Object property names

NPM: Valibot: record issue paths can make flatten throw for inherited Object property names vulnerability discovered by ? in WordPress Npm valibot versions = 1.4.1...

Improper Handling of Exceptional Conditions

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the flatten process. An attacker can cause the application to throw a TypeError and disrupt normal error...

Valibot: record() issue paths can make flatten() throw for inherited Object property names

Summary valibot 1.4.1 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record intentionally filters proto, prototype, and constructo...

@0xfutbol/id (>=2.0.0, <=2.0.200), @ack-lab/sdk (>=0.0.5, <=0.1.1) +771 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0-beta.0, <=1.4.1)

valibot NPM version =1.0.0-beta.0, =2.0.0, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alexanderlee/addon-mcp 0.3.4 - @alexanderlee/mcp 0.5.1 and more Source cve...

@0xfutbol/id (>=2.0.0, <=2.0.200), @ack-lab/sdk (>=0.0.5, <=0.1.1) +771 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0-beta.0, <=1.4.1)

valibot NPM version =1.0.0-beta.0, =2.0.0, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alexanderlee/addon-mcp 0.3.4 - @alexanderlee/mcp 0.5.1 and more Source cve...

@0xfutbol/id (>=2.0.0, <=2.0.200), @ack-lab/sdk (>=0.0.5, <=0.1.1) +771 more potentially affected by CVE-2026-59952 via valibot (>=1.0.0-beta.0, <=1.4.1)

valibot NPM version =1.0.0-beta.0, =2.0.0, =0.0.5, =4.3.136-beta.1, =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.4.0, =0.0.27, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =2.0.0-beta.77 - @alchemy.run/prisma 2.0.0-beta.84 - @alexanderlee/addon-mcp 0.3.4 - @alexanderlee/mcp 0.5.1 and more Source cve...

GHSA-5QJJ-4XWW-7PHC Valibot: record() issue paths can make flatten() throw for inherited Object property names

Summary valibot 1.4.1 can throw a TypeError inside its flatten helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record validation. record intentionally filters proto, prototype, and constructo...

PT-2026-64442

Name of the Vulnerable Software and Affected Versions Valibot versions prior to 1.4.2 Description Valibot can throw a TypeError within its flatten helper when validation issues contain object keys controlled by an attacker that collide with inherited Object.prototype properties, such as toString,...