Valibot is a data validation library that uses schemas. In versions before 1.4.2, the flatten() helper function can throw a TypeError when validation issues contain keys that are attacker-controlled and collide with Object.prototype properties like toString, valueOf, or hasOwnProperty. The record() validation method filters some dangerous keys (__proto__, prototype, constructor) but still accepts keys that shadow inherited Object.prototype methods. If such keys cause validation errors, flatten() tries to push errors onto a function inherited from Object.prototype instead of an array, causing a TypeError and crashing the application. This is not a prototype pollution vulnerability but an error handling flaw affecting availability. The vulnerability is fixed in version 1.4.2.

Applications using Valibot versions prior to 1.4.2 that validate user-controlled objects with record() and then flatten validation errors may crash with a TypeError instead of returning structured validation errors. This leads to denial of service or degraded availability during request processing. There is no evidence of code execution or data corruption. The impact is limited to error handling and availability.

Upgrade Valibot to version 1.4.2 or later, where this issue is fixed. No other mitigations are documented. Patch status is not explicitly stated in the vendor advisory, but the description confirms the fix in 1.4.2. If upgrading is not immediately possible, avoid passing validation issues containing keys that shadow Object.prototype properties to the flatten() helper.