Description
valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty.
The issue is reachable through normal record() validation.
Recommendation
Update the valibot package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.4.1
- Patched version(s): 1.4.2
References
Could your website be exposed too?
SmartScanner can check your website for Valibot: record() issue paths can make flatten() throw for inherited Object property names and gives you actionable findings to investigate.
Start a free scanRelated Issues
- msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079
- protobufjs : Schema-derived names can shadow runtime-significant properties - CVE-2026-54269
- protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
- Unsafe object property setter in mathjs - CVE-2026-40897
You might also like:
See something that needs correcting? Let us knowUpdated July 24, 2026