Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
10 vulnerabilities found for joi by hapijs
CVE-2026-92599 (GCVE-0-2026-92599)
Vulnerability from nvd – Published: 2026-09-16 21:47 – Updated: 2026-09-18 20:06
VLAI
EPSS
VEX
Title
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Summary
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:06 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:06:34.166545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:06:43.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.7",
"status": "affected",
"version": "17.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "17.13.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "18.2.6",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "18.2.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qrn12580"
},
{
"lang": "en",
"type": "finder",
"value": "yfwmaniish"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi (npm package `joi`, hapi.js) versions \u003e=17.2.0 \u003c17.13.7 and \u003e=18.0.0 \u003c18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T21:47:03.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6h2x-m376-mqjq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq"
},
{
"name": "VulnCheck Advisory: Joi before 17.13.7 and 18.2.6 ReDoS via isoDate",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"
}
],
"title": "Joi before 17.13.7 and 18.2.6 ReDoS via isoDate",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92599",
"datePublished": "2026-09-16T21:47:03.073Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-18T20:06:43.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90771 (GCVE-0-2026-90771)
Vulnerability from nvd – Published: 2026-09-13 10:45 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:02 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/issues/3150 | issue-tracking |
| https://github.com/hapijs/joi | product |
| https://github.com/hapijs/joi/blob/v18.2.8/lib/me… | technical-description |
| https://github.com/hapijs/joi/commit/5b8333c9177e… | patch |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:02:28.580545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:03:23.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hapijs/joi/issues/3150"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.8",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThan": "18.2.9",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:52.339Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3150",
"tags": [
"issue-tracking"
],
"url": "https://github.com/hapijs/joi/issues/3150"
},
{
"tags": [
"product"
],
"url": "https://github.com/hapijs/joi"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"
},
{
"name": "VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"
}
],
"title": "joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90771",
"datePublished": "2026-09-13T10:45:42.498Z",
"dateReserved": "2026-09-13T10:14:57.680Z",
"dateUpdated": "2026-09-24T14:21:52.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84368 (GCVE-0-2026-84368)
Vulnerability from nvd – Published: 2026-09-01 20:36 – Updated: 2026-09-02 12:18
VLAI
EPSS
VEX
Title
joi: Prototype pollution via a `__proto__` language key in custom messages
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:11 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3138 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3139 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/8d0b808f3e87… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/90d07571923c… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:11:08.547444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:18:07.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c= 17.1.1"
},
{
"status": "affected",
"version": "\u003e= 17.2.0, \u003c 17.13.6"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:36:51.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"name": "https://github.com/hapijs/joi/pull/3138",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"name": "https://github.com/hapijs/joi/pull/3139",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"name": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"name": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
}
],
"source": {
"advisory": "GHSA-6w3j-5fw6-r9vr",
"discovery": "UNKNOWN"
},
"title": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84368",
"datePublished": "2026-09-01T20:36:51.859Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T12:18:07.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84367 (GCVE-0-2026-84367)
Vulnerability from nvd – Published: 2026-09-01 20:33 – Updated: 2026-09-03 15:58
VLAI
EPSS
VEX
Title
joi: object().rename() with a template target can set the validated object's prototype
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:58 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3134 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3135 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/162f367aa178… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/172ececa192f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:58:17.940373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:58:42.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 17.13.5"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi\u0027s lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern\u0027s own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:33:29.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"name": "https://github.com/hapijs/joi/pull/3134",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"name": "https://github.com/hapijs/joi/pull/3135",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"name": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"name": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
}
],
"source": {
"advisory": "GHSA-gg4h-3hg2-grpc",
"discovery": "UNKNOWN"
},
"title": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84367",
"datePublished": "2026-09-01T20:33:29.295Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-03T15:58:42.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48038 (GCVE-0-2026-48038)
Vulnerability from nvd – Published: 2026-07-14 19:24 – Updated: 2026-07-15 13:27
VLAI
EPSS
VEX
Title
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Summary
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:23 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3113 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/97bd51de94d5… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/fc146a628ab9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:23:16.760424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:27:13.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 17.13.4"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:24:32.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"
},
{
"name": "https://github.com/hapijs/joi/pull/3113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3113"
},
{
"name": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74"
},
{
"name": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7"
}
],
"source": {
"advisory": "GHSA-q7cg-457f-vx79",
"discovery": "UNKNOWN"
},
"title": "joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48038",
"datePublished": "2026-07-14T19:24:32.644Z",
"dateReserved": "2026-05-20T18:15:53.577Z",
"dateUpdated": "2026-07-15T13:27:13.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92599 (GCVE-0-2026-92599)
Vulnerability from cvelistv5 – Published: 2026-09-16 21:47 – Updated: 2026-09-18 20:06
VLAI
EPSS
VEX
Title
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Summary
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:06 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:06:34.166545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:06:43.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.7",
"status": "affected",
"version": "17.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "17.13.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "18.2.6",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "18.2.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qrn12580"
},
{
"lang": "en",
"type": "finder",
"value": "yfwmaniish"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi (npm package `joi`, hapi.js) versions \u003e=17.2.0 \u003c17.13.7 and \u003e=18.0.0 \u003c18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T21:47:03.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6h2x-m376-mqjq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq"
},
{
"name": "VulnCheck Advisory: Joi before 17.13.7 and 18.2.6 ReDoS via isoDate",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"
}
],
"title": "Joi before 17.13.7 and 18.2.6 ReDoS via isoDate",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92599",
"datePublished": "2026-09-16T21:47:03.073Z",
"dateReserved": "2026-09-16T13:48:49.970Z",
"dateUpdated": "2026-09-18T20:06:43.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90771 (GCVE-0-2026-90771)
Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:02 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/issues/3150 | issue-tracking |
| https://github.com/hapijs/joi | product |
| https://github.com/hapijs/joi/blob/v18.2.8/lib/me… | technical-description |
| https://github.com/hapijs/joi/commit/5b8333c9177e… | patch |
| https://www.vulncheck.com/advisories/joi-before-1… | third-party-advisory |
Impacted products
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:02:28.580545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:03:23.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/hapijs/joi/issues/3150"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/joi",
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"lessThan": "17.13.8",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThan": "18.2.9",
"status": "affected",
"version": "18.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:52.339Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3150",
"tags": [
"issue-tracking"
],
"url": "https://github.com/hapijs/joi/issues/3150"
},
{
"tags": [
"product"
],
"url": "https://github.com/hapijs/joi"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"
},
{
"tags": [
"patch"
],
"url": "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"
},
{
"name": "VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"
}
],
"title": "joi before 17.13.8 and 18.2.9 Prototype Pollution via messages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90771",
"datePublished": "2026-09-13T10:45:42.498Z",
"dateReserved": "2026-09-13T10:14:57.680Z",
"dateUpdated": "2026-09-24T14:21:52.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84368 (GCVE-0-2026-84368)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:36 – Updated: 2026-09-02 12:18
VLAI
EPSS
VEX
Title
joi: Prototype pollution via a `__proto__` language key in custom messages
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:11 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3138 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3139 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/8d0b808f3e87… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/90d07571923c… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84368",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:11:08.547444Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:18:07.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c= 17.1.1"
},
{
"status": "affected",
"version": "\u003e= 17.2.0, \u003c 17.13.6"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:36:51.859Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
},
{
"name": "https://github.com/hapijs/joi/pull/3138",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3138"
},
{
"name": "https://github.com/hapijs/joi/pull/3139",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3139"
},
{
"name": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
},
{
"name": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
}
],
"source": {
"advisory": "GHSA-6w3j-5fw6-r9vr",
"discovery": "UNKNOWN"
},
"title": "joi: Prototype pollution via a `__proto__` language key in custom messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84368",
"datePublished": "2026-09-01T20:36:51.859Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-02T12:18:07.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84367 (GCVE-0-2026-84367)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:33 – Updated: 2026-09-03 15:58
VLAI
EPSS
VEX
Title
joi: object().rename() with a template target can set the validated object's prototype
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:58 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3134 | x_refsource_MISC |
| https://github.com/hapijs/joi/pull/3135 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/162f367aa178… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/172ececa192f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:58:17.940373Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T15:58:42.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 17.13.5"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi\u0027s lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern\u0027s own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:33:29.295Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
},
{
"name": "https://github.com/hapijs/joi/pull/3134",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3134"
},
{
"name": "https://github.com/hapijs/joi/pull/3135",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3135"
},
{
"name": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
},
{
"name": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
}
],
"source": {
"advisory": "GHSA-gg4h-3hg2-grpc",
"discovery": "UNKNOWN"
},
"title": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84367",
"datePublished": "2026-09-01T20:33:29.295Z",
"dateReserved": "2026-09-01T16:27:58.129Z",
"dateUpdated": "2026-09-03T15:58:42.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48038 (GCVE-0-2026-48038)
Vulnerability from cvelistv5 – Published: 2026-07-14 19:24 – Updated: 2026-07-15 13:27
VLAI
EPSS
VEX
Title
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Summary
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:23 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/hapijs/joi/security/advisories… | x_refsource_CONFIRM |
| https://github.com/hapijs/joi/pull/3113 | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/97bd51de94d5… | x_refsource_MISC |
| https://github.com/hapijs/joi/commit/fc146a628ab9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:23:16.760424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:27:13.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joi",
"vendor": "hapijs",
"versions": [
{
"status": "affected",
"version": "\u003c 17.13.4"
},
{
"status": "affected",
"version": "\u003e= 18.0.0, \u003c 18.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T19:24:32.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"
},
{
"name": "https://github.com/hapijs/joi/pull/3113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/pull/3113"
},
{
"name": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74"
},
{
"name": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7"
}
],
"source": {
"advisory": "GHSA-q7cg-457f-vx79",
"discovery": "UNKNOWN"
},
"title": "joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-48038",
"datePublished": "2026-07-14T19:24:32.644Z",
"dateReserved": "2026-05-20T18:15:53.577Z",
"dateUpdated": "2026-07-15T13:27:13.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}