[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
joi	17.13.3 → 17.13.9

---

joi has an uncaught RangeError on deeply nested input through recursive link() schemas

CVE-2026-48038 / GHSA-q7cg-457f-vx79

More information

Details

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
• Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References

• Pull request: fix: protect link recursion from max call stack hapijs/joi#3113

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79
• https://github.com/hapijs/joi/pull/3113
• https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
• https://github.com/advisories/GHSA-q7cg-457f-vx79

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi: Prototype pollution via a __proto__ language key in custom messages

CVE-2026-84368 / GHSA-6w3j-5fw6-r9vr

More information

Details

Impact

An application that passes attacker-controlled data into joi's custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named __proto__ was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named constructor did the same to the Object function's statics. A consuming application that gates on the mere presence of a property (if (user.isAdmin)) can be made to take the wrong branch for every object it inspects.

This is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.

Patches

Upgrade to version 18.2.5 or 17.13.6.

Workarounds

Do not pass untrusted input into messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message }). Or validate that they don't contain any __proto__ or constructor property.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
• https://nvd.nist.gov/vuln/detail/CVE-2026-84368
• https://github.com/hapijs/joi/pull/3138
• https://github.com/hapijs/joi/pull/3139
• https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
• https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
• https://github.com/advisories/GHSA-6w3j-5fw6-r9vr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi: object().rename() with a template target can set the validated object's prototype

CVE-2026-84367 / GHSA-gg4h-3hg2-grpc

More information

Details

Impact

Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#​1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-__proto__ with an object value and make the rename target render as __proto__, which sets the prototype of the object joi returns instead of creating a key on it. The global Object.prototype is not modified, so the effect is confined to the object returned by that one validate() call.

Schemas using a static string rename target are not affected, and neither are schemas left on the default { multiple: false }.

Patches

Versions 17.13.5 and 18.2.4 have been released to address the issue.

Workarounds

1. Replace the template rename target with a static string target.
2. Keep the template but make the capture unable to produce __proto__, using a negative lookahead: .rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#​1}'), { multiple: true })
3. Drop { multiple: true } from the rename, which stops the rename before the assignment.

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc
• https://nvd.nist.gov/vuln/detail/CVE-2026-84367
• https://github.com/hapijs/joi/pull/3134
• https://github.com/hapijs/joi/pull/3135
• https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6
• https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01
• https://github.com/hapijs/joi/releases/tag/v17.13.5
• https://github.com/hapijs/joi/releases/tag/v18.2.4
• https://github.com/advisories/GHSA-gg4h-3hg2-grpc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi: Quadratic regular-expression backtracking in Joi.string().isoDate()

CVE-2026-92599 / GHSA-6h2x-m376-mqjq

More information

Details

Impact

Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s.

Patches

Upgrade to version 17.13.7 or 18.2.6 depending on your current major version.

Workarounds

None except capping the length of the string before it reaches joi.

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://github.com/hapijs/joi/pull/3143
• https://github.com/hapijs/joi/pull/3145
• https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec
• https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245
• https://nvd.nist.gov/vuln/detail/CVE-2026-92599
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate
• https://github.com/advisories/GHSA-6h2x-m376-mqjq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi messages compilation allows prototype replacement through proto error codes

CVE-2026-90771 / GHSA-wr44-6hxh-3jwq

More information

Details

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-90771
• https://github.com/hapijs/joi/issues/3150
• https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb
• https://github.com/hapijs/joi
• https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
• https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages
• https://github.com/hapijs/joi/pull/3151
• https://github.com/hapijs/joi/pull/3153
• https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2
• https://github.com/hapijs/joi/releases/tag/v17.13.8
• https://github.com/hapijs/joi/releases/tag/v18.2.9
• https://github.com/advisories/GHSA-wr44-6hxh-3jwq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi: quadratic-time split in string().email({ multiple: true }) allows denial of service

CVE-2026-118772 / GHSA-4528-x5fx-h6hg

More information

Details

Summary

Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

Details

When the multiple option is set, the email rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);
// ...
const emails = options.multiple ? value.split(regex) : [value];

String.prototype.split tries a match at each position of the value. At each position inside a whitespace run, the leading \s* reads the rest of the run, does not find a separator, and backtracks through all of it. A run of n whitespace characters without a separator therefore costs n² steps. This applies to the default separator and to all custom separator values.

The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

const regex = new RegExp(`(?:(?<!\\s)\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);

The split results do not change. The regular expression is now built only when multiple is set.

Every joi release from 17.1.1 up to and including 17.13.8, and from 18.0.0 up to and including 18.3.0, is affected. Every @hapi/joi release from 16.0.0 is affected.

Workarounds for users who cannot upgrade:

• Add .max() before .email(), for example Joi.string().max(1000).email({ multiple: true }). The max rule then rejects long values before the email rule runs.
• Do not use the abortEarly: false option with this schema. With abortEarly: false, the email rule runs even when the max rule fails.
• Do not use .trim() as a workaround. It removes only the whitespace at the start and at the end of the value.

Proof of concept

const Joi = require('joi');

const schema = Joi.string().email({ multiple: true });
for (const n of [25000, 50000, 100000, 200000]) {
    const start = Date.now();
    schema.validate(' '.repeat(n));
    console.log(`${n} spaces: ${Date.now() - start} ms`);
}

Output on joi@18.3.0 (Node.js 26):

25000 spaces: 244 ms
50000 spaces: 887 ms
100000 spaces: 3349 ms
200000 spaces: 13579 ms

Output on the patched version:

25000 spaces: 0 ms
50000 spaces: 0 ms
100000 spaces: 0 ms
200000 spaces: 1 ms

Over HTTP, send the whitespace in a field that the route validates with this schema:

POST /invite HTTP/1.1
Content-Type: application/json

{"emails": "<100000 spaces>"}

Impact

This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with Joi.string().email({ multiple: true }) and that has no length limit before the email rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg
• https://nvd.nist.gov/vuln/detail/CVE-2026-118772
• https://github.com/hapijs/joi/pull/3162
• https://github.com/hapijs/joi/pull/3163
• https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf
• https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e
• https://github.com/hapijs/joi/releases/tag/v17.13.9
• https://github.com/hapijs/joi/releases/tag/v18.3.1
• https://github.com/advisories/GHSA-4528-x5fx-h6hg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hapijs/joi (joi)

v17.13.9

Compare Source

v17.13.8

Compare Source

v17.13.7

Compare Source

v17.13.6

Compare Source

v17.13.5

Compare Source

v17.13.4

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.