CVE-2026-59952: CWE-755: Improper Handling of Exceptional Conditions in open-circle valibot
Valibot versions prior to 1.4.2 have an issue where validation errors involving attacker-controlled object keys such as toString, valueOf, or hasOwnProperty can cause a TypeError in the flatten() helper. This occurs because the flatten() function attempts to push errors onto inherited Object.prototype methods instead of error arrays, leading to application crashes during validation error handling. This vulnerability affects availability by causing request path crashes instead of returning structured validation errors. The issue is fixed in version 1.4.2.
AI Analysis
Technical Summary
Valibot is a data validation library that uses schemas. In versions before 1.4.2, when validating objects with keys that collide with inherited Object.prototype properties (e.g., toString, valueOf, hasOwnProperty), and if these keys are rejected by the record key or value schema, the resulting validation issues include these keys in the error path. The flatten() helper then mistakenly treats these inherited methods as error arrays and calls .push() on them, causing a TypeError. This is not a prototype pollution vulnerability but an improper handling of exceptional conditions (CWE-755) that leads to application crashes during error processing. The issue is resolved in version 1.4.2.
Potential Impact
The vulnerability impacts application availability by causing a TypeError crash when processing validation errors involving certain object keys. This prevents the application from returning structured validation error responses and instead crashes the request path. There is no indication of privilege escalation, data disclosure, or remote code execution. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Valibot to version 1.4.2 or later, where this issue is fixed. No other mitigations are indicated or required.
CVE-2026-59952: CWE-755: Improper Handling of Exceptional Conditions in open-circle valibot
Description
Valibot versions prior to 1.4.2 have an issue where validation errors involving attacker-controlled object keys such as toString, valueOf, or hasOwnProperty can cause a TypeError in the flatten() helper. This occurs because the flatten() function attempts to push errors onto inherited Object.prototype methods instead of error arrays, leading to application crashes during validation error handling. This vulnerability affects availability by causing request path crashes instead of returning structured validation errors. The issue is fixed in version 1.4.2.
CVSS v4.0
Score 6.9medium
Affected software
open-circle
valibot
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Valibot is a data validation library that uses schemas. In versions before 1.4.2, when validating objects with keys that collide with inherited Object.prototype properties (e.g., toString, valueOf, hasOwnProperty), and if these keys are rejected by the record key or value schema, the resulting validation issues include these keys in the error path. The flatten() helper then mistakenly treats these inherited methods as error arrays and calls .push() on them, causing a TypeError. This is not a prototype pollution vulnerability but an improper handling of exceptional conditions (CWE-755) that leads to application crashes during error processing. The issue is resolved in version 1.4.2.
Potential Impact
The vulnerability impacts application availability by causing a TypeError crash when processing validation errors involving certain object keys. This prevents the application from returning structured validation error responses and instead crashes the request path. There is no indication of privilege escalation, data disclosure, or remote code execution. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade Valibot to version 1.4.2 or later, where this issue is fixed. No other mitigations are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T18:49:15.607Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6aa0b59c2644c7f849c1bf
Added to database: 07/30/2026, 00:54:13 UTC
Last enriched: 08/06/2026, 17:53:24 UTC
Last updated: 09/12/2026, 22:01:35 UTC
Views: 109
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.