chore(deps): update dependency valibot to v1.4.2 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
valibot (source)	1.2.0 → 1.4.2

---

Valibot: record() issue paths can make flatten() throw for inherited Object property names

CVE-2026-59952 / GHSA-5qjj-4xww-7phc

More information

Details

Summary

valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty.

The issue is reachable through normal record() validation. record() intentionally filters __proto__, prototype, and constructor, but it still accepts other own keys that collide with inherited Object.prototype properties. If the record key schema or value schema rejects such an entry, Valibot creates an issue path containing that key. Passing the resulting issues to Valibot's documented flatten() helper causes flatErrors.nested[dotPath] to resolve to the inherited method instead of an own error array, and the helper calls .push(...) on that function.

This is not a global prototype pollution issue. The impact is availability/error handling: applications that validate user-controlled objects with record() and flatten validation errors for API responses can crash the request path with a TypeError instead of returning structured validation errors.

Affected package

• Ecosystem: npm
• Package: valibot
• Affected version verified: 1.4.1
• Fixed version: none known
• Repository: open-circle/valibot
• Current main ref tested by source review: 9bb6617

Root cause

record() uses _isValidObjectKey() before validating record entries. The helper blocks the three classic prototype pollution keys:

key !== '__proto__' &&
key !== 'prototype' &&
key !== 'constructor'

It does not block other inherited Object.prototype names such as toString, valueOf, and hasOwnProperty. These remain valid own JSON object keys and can appear in issue paths when either the record key schema or value schema rejects the entry.

flatten() then creates nested error storage with an ordinary object:

flatErrors.nested = {};

For a dot path such as toString, this check reads the inherited Object.prototype.toString function:

if (flatErrors.nested![dotPath]) {
  flatErrors.nested![dotPath]!.push(issue.message);
}

Because the inherited function is truthy, flatten() calls .push(...) on a function and throws TypeError: flatErrors.nested[dotPath].push is not a function.

Impact

A remote attacker can trigger this if an application:

1. validates attacker-controlled JSON objects with v.record(...);
2. receives an invalid key or invalid value under a key such as toString;
3. uses Valibot's flatten(result.issues) helper to prepare validation errors.

This is a common pattern in API/form validation: safeParse() collects issues and flatten() converts them into response-friendly error objects. Instead of a validation response, the request can hit an unexpected exception path.

The same root cause can also affect manually constructed issues or other schemas that place inherited Object property names into dot paths. I am reporting the record() path because it uses only public Valibot APIs and attacker-controlled JSON keys.

Local reproduction

Run in a disposable directory:

npm install valibot@1.4.1
node poc_record_flatten_inherited_key_dos.mjs

Minimal example:

import * as v from 'valibot';

const schema = v.record(v.string(), v.number());
const input = JSON.parse('{"toString":"not-a-number"}');

const result = v.safeParse(schema, input);
console.log(result.success); // false
console.log(result.issues[0].path.map((item) => item.key)); // ["toString"]

v.flatten(result.issues); // TypeError

Observed output from valibot@1.4.1:

{
  "name": "record value schema rejects attacker-controlled value",
  "key": "toString",
  "success": false,
  "issueCount": 1,
  "firstPath": ["toString"],
  "firstMessage": "Invalid type: Expected number but received \"not-a-number\"",
  "flattened": {
    "ok": false,
    "exception": "TypeError",
    "message": "flatErrors.nested[dotPath].push is not a function"
  }
}

The local PoC also reproduces the same exception for valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable, and toLocaleString. A control case with an ordinary key produces normal flattened errors.

Duplicate checks performed before submission

• npm metadata confirmed current valibot release is 1.4.1 and maps to open-circle/valibot.
• gh api repos/open-circle/valibot/private-vulnerability-reporting returned {"enabled":true}.
• npm audit for a clean project containing only valibot@1.4.1 returned no vulnerabilities.
• Repository advisories and the GitHub Advisory Database only returned the historical emoji ReDoS advisory fixed in 1.2.0.
• OSV exact-version query for npm valibot 1.4.1 returned no vulnerabilities.
• Public issue/PR searches for flatten toString, flatten hasOwnProperty, record toString, __proto__, constructor, and prototype pollution did not find a matching disclosure of this record() issue-path / flatten() exception.
• Reviewed related public PRs: open-circle/valibot#67 added prototype pollution mitigation for record() by blacklisting __proto__, prototype, and constructor; it does not cover flatten() collisions with other inherited property names. open-circle/valibot#1429 is an open plain-object / record() type semantics PR and does not disclose this flatten() exception behavior.

Suggested remediation

Use null-prototype containers for flat error maps and/or perform own-property checks before appending:

• Initialize flatErrors.nested as Object.create(null).
• Check nested entries with Object.prototype.hasOwnProperty.call(flatErrors.nested, dotPath) rather than truthiness.
• Consider filtering or escaping unsafe dot path segments in getDotPath() / flatten(), including inherited Object property names.
• Add regression tests for flatten() with paths toString, valueOf, hasOwnProperty, __proto__, prototype, and constructor.
• Consider using the same hardening for other accumulator objects that store attacker-controlled keys.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/open-circle/valibot/security/advisories/GHSA-5qjj-4xww-7phc
• https://github.com/open-circle/valibot/pull/1522
• https://github.com/open-circle/valibot/commit/1bd01c304657cd0809cc92694360b6cc60f700bf
• https://github.com/open-circle/valibot/releases/tag/v1.4.2
• https://github.com/advisories/GHSA-5qjj-4xww-7phc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-circle/valibot (valibot)

v1.4.2

Compare Source

Many thanks to @​Faze-up and @​chatman-media for contributing to this release.

• Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #​1521)
• Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #​1522)
• Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #​1522)

v1.4.1

Compare Source

• Fix intersect schema to infer correct input and output types for non-tuple array options instead of never (pull request #​1478)

v1.4.0

Compare Source

Many thanks to @​ksaurav24, @​heiwen, @​compulim, @​ysknsid25, @​alaycock-stripe, @​IlyaSemenov, @​wszgrcy, @​LMGO, @​yslpn, @​EltonLobo07 and @​Eronmmer for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add isoDateTimeSecond validation action to validate ISO date times with seconds (pull request #​1418)
• Add toCamelCase, toKebabCase, toPascalCase and toSnakeCase transformation actions to convert strings between common naming conventions (pull request #​1457)
• Change internal ReadonlyOutputKeys and OutputWithReadonly types of object schemas and WithReadonly type of record schemas to improve TypeScript type performance (pull request #​1442)
• Change hot paths to reduce object allocations and improve runtime performance (pull request #​1437)
• Change build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax (pull request #​1455)
• Change internal _LruCache to use a TypeScript private method instead of a #private class field to avoid runtime helpers in the transpiled output (pull request #​1455)
• Change internal _isValidObjectKey to use Object.prototype.hasOwnProperty.call instead of Object.hasOwn so the distributed output stays compatible with runtimes that lack the ES2022 Object.hasOwn builtin (pull request #​1421)
• Change flatten method to accept readonly issue arrays (pull request #​1269)
• Fix potential RangeError caused by spreading large issue arrays (pull request #​1437)
• Fix creditCard validation action to reject Mastercard numbers with invalid lengths (pull request #​1462)
• Fix intersect schema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #​1463)

v1.3.1

Compare Source

• Change MAC48_REGEX, MAC64_REGEX and MAC_REGEX to drop the i flag for better JSON Schema compatibility (pull request #​1430)
• Change hash action to use case-expanded character classes instead of the i flag (pull request #​1430)

v1.3.0

Compare Source

Many thanks to @​EskiMojo14, @​yslpn, @​alexilyaev, @​idleberg, @​BerkliumBirb and @​frenzzy for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add guard transformation action to narrow types using type predicates (pull request #​1204)
• Add parseBoolean transformation action to parse boolean values from strings and other types (pull request #​1251)
• Add isrc validation action to validate ISRC codes (pull request #​1373)
• Add cache method for caching schema output by input (pull request #​1170)
• Add domain validation action to validate domain names (pull request #​1284)
• Add jwsCompact validation action to validate JWS compact strings (pull request #​1348)
• Fix creditCard validation action to allow 13-digit Visa card numbers (pull request #​1347)
• Fix isoTimestamp validation action to allow optional space before UTC offset for PostgreSQL timestamptz compatibility (pull request #​1195)
• Fix types for deeply readonly default and fallback values

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from ae96d23:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/ae96d230f310a36237f58385ca684ecb7f12d87d

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16502

[changeset-bot]

⚠️ No Changeset found

Latest commit: ae96d23

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[svelte-docs-bot]

Preview: https://svelte-dev-git-preview-kit-16502-svelte.vercel.app/