The vulnerability in Valibot occurs when the library’s flatten helper processes validation errors that contain attacker‑controlled keys such as toString, valueOf, or hasOwnProperty. These keys are not filtered by record() and become part of an issue path. When flatten attempts to push the error to an inherited Object prototype method, a TypeError is thrown, causing the application to crash instead of returning structured validation errors. This results in a denial‑of‑service condition for requests that exercise this code path.

Affected products are the Valibot validation library from open‑circle, versions earlier than 1.4.2. All applications that depend on these versions and use record() validation followed by flatten of errors are at risk.

The CVSS score is 6.9, indicating moderate severity, and the EPSS score is less than 1 %, making exploitation unlikely under current threat landscape. It is not listed in the CISA KEV catalog. Attackers can trigger the error by submitting crafted JSON containing forbidden keys via any input that is validated with record() and subsequently flattened. While it does not allow code execution or data exposure, the TypeError leads to a denial‑of‑service by terminating the request processing pipeline.