CVE-2026-90771
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Risk Assessment
Replacing an object's prototype can break application code that relies on Object.prototype methods, causing failures or potentially enabling further attacks depending on usage context.
Recommendation
Upgrade joi to version 17.13.8 or 18.2.9 (or later) to eliminate the ability to inject a __proto__ key in messages.
Other vulnerabilities in joi
See all- CVE-2026-92599High
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
- CVE-2026-84368Low
The joi library (and @hapi/joi) has a prototype pollution vulnerability in lib/messages.js. The exports.compile() and exports.merge() functions reuse inherited objects for attacker-controlled language keys, allowing properties to be written to Object.prototype.
- CVE-2026-84367Low
In the joi library, there is a vulnerability in the internals.rename() implementation used by object().rename(). It allows creating a schema that, using a regular expression and a Joi.expression() or Joi.x() target with match data interpolation, can set the prototype of the object returned by validate() to __proto__ instead of creating an own key.
- CVE-2026-48038Medium
A vulnerability in the joi library (versions before 17.13.4 and 18.2.1) allows a DoS attack by sending deeply nested JSON or objects with recursive link() schemas. Calling validate() without try/catch in a request handler can cause an unhandled RangeError and potentially crash the process.
Original NVD description (English source)
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS