{"action":"Upgrade valibot to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"0"}],"component":"valibot","cve_ids":["CVE-2026-59952"],"ecosystem":"npm","epss":0.00383,"exploited":false,"fixed_versions":["1.4.2"],"ghsa_id":"GHSA-5qjj-4xww-7phc","id":"tcs_01M5KF4FJB4YSQFRCN5ME15AZA","modified_at":"2026-07-24T16:33:10.281535Z","published_at":"2026-07-24T16:14:31Z","references":["https://osv.dev/vulnerability/GHSA-5qjj-4xww-7phc","https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc","https://github.com/open-circle/valibot/pull/1522","https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf","https://github.com/open-circle/valibot","https://github.com/open-circle/valibot/releases/tag/v1.4.2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5qjj-4xww-7phc","url":"https://osv.dev/vulnerability/GHSA-5qjj-4xww-7phc"}],"summary":"Valibot: record() issue paths can make flatten() throw for inherited Object property names"}