GHSA-GG4H-3HG2-GRPC

Vulnerability from github – Published: 2026-09-08 20:51 – Updated: 2026-09-08 20:51
VLAI
Summary
joi: object().rename() with a template target can set the validated object's prototype
Details

Impact

Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-__proto__ with an object value and make the rename target render as __proto__, which sets the prototype of the object joi returns instead of creating a key on it. The global Object.prototype is not modified, so the effect is confined to the object returned by that one validate() call.

Schemas using a static string rename target are not affected, and neither are schemas left on the default { multiple: false }.

Patches

Versions 17.13.5 and 18.2.4 have been released to address the issue.

Workarounds

  1. Replace the template rename target with a static string target.
  2. Keep the template but make the capture unable to produce __proto__, using a negative lookahead: .rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true })
  3. Drop { multiple: true } from the rename, which stops the rename before the assignment.
Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "joi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "17.13.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "joi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "18.0.0"
            },
            {
              "fixed": "18.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84367"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:51:21Z",
    "nvd_published_at": "2026-09-01T21:18:47Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nApplications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern\u0027s own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x(\u0027{#1}\u0027), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.\n\nSchemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.\n\n### Patches\n\nVersions 17.13.5 and 18.2.4 have been released to address the issue.\n\n### Workarounds\n\n1. Replace the template rename target with a static string target.\n2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x(\u0027{#1}\u0027), { multiple: true })`\n3. Drop { multiple: true } from the rename, which stops the rename before the assignment.",
  "id": "GHSA-gg4h-3hg2-grpc",
  "modified": "2026-09-08T20:51:21Z",
  "published": "2026-09-08T20:51:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84367"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/pull/3134"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/pull/3135"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hapijs/joi"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/releases/tag/v17.13.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hapijs/joi/releases/tag/v18.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "joi: object().rename() with a template target can set the validated object\u0027s prototype"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.