Threats Tagged 'cve-2026-59952'

Valibot versions prior to 1.4.2 have an improper handling of exceptional conditions vulnerability in the flatten() helper function. When validation issues involve attacker-controlled object keys that collide with inherited Object.prototype properties (such as toString, valueOf, or hasOwnProperty), the flatten() function may throw a TypeError. This occurs because the function attempts to push errors onto an inherited method instead of an error array. The issue affects applications using record() validation combined with flatten() to process validation errors. This vulnerability can cause application crashes during request handling, impacting availability. The issue is fixed in version 1.4.2.