Skip to content
OpenAdvisories

Package · npm

valibot

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.9
    CVE-2026-59952

    Valibot: record() issue paths can make flatten() throw for inherited Object property names

    Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through n…

    open-circle valibot valibot npm
  • High 7.5
    CVE-2025-66020

    Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

    Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can caus…

    open-circle valibot valibot npm