CVE-2026-48038
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in the joi library (versions before 17.13.4 and 18.2.1) allows a DoS attack by sending deeply nested JSON or objects with recursive link() schemas. Calling validate() without try/catch in a request handler can cause an unhandled RangeError and potentially crash the process.
Risk Assessment
An attacker can cause application downtime (process crash) by sending a specially crafted request with deeply nested data, resulting in denial of service (DoS).
Recommendation
Immediately update the joi library to version 17.13.4 or 18.2.1 (or later). As a workaround, use try/catch around validate() calls and limit the nesting depth of input data.
Other vulnerabilities in joi
See all- CVE-2026-84368Low
The joi library (and @hapi/joi) has a prototype pollution vulnerability in lib/messages.js. The exports.compile() and exports.merge() functions reuse inherited objects for attacker-controlled language keys, allowing properties to be written to Object.prototype.
- CVE-2026-84367Low
In the joi library, there is a vulnerability in the internals.rename() implementation used by object().rename(). It allows creating a schema that, using a regular expression and a Joi.expression() or Joi.x() target with match data interpolation, can set the prototype of the object returned by validate() to __proto__ instead of creating an own key.
Original NVD description (English source)
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.