Valibot: record() issue paths can make flatten() throw for inherited Object property names

Description

valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty.

The issue is reachable through normal record() validation.

Recommendation

Update the valibot package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.4.1
• Patched version(s): 1.4.2

References

• GHSA-5qjj-4xww-7phc
• CVE-2026-59952
• CWE-755
• CAPEC-310
• OWASP 2021-A6

Related Issues

• msgpackr's conversion of property names to strings can trigger infinite recursion - CVE-2023-52079
• protobufjs : Schema-derived names can shadow runtime-significant properties - CVE-2026-54269
• protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
• Unsafe object property setter in mathjs - CVE-2026-40897

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

valibot