npm/valibot CVE-2026-59952: medium, EPSS 0.52%
Valibot: record() issue paths can make flatten() throw for inherited Object property names
Action: Upgrade valibot to 1.4.2 or later.
npm i valibot@1.4.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.2 | - |
Fixed versions
| 1.4.2 |
Sources
- osv: GHSA-5qjj-4xww-7phc
- https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc
- https://github.com/open-circle/valibot/pull/1522
- https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf
- https://github.com/open-circle/valibot
- https://github.com/open-circle/valibot/releases/tag/v1.4.2
CVE-2026-59952 · published · modified · JSON