joi vulnerabilities

The joi library (and @hapi/joi) has a prototype pollution vulnerability in lib/messages.js. The exports.compile() and exports.merge() functions reuse inherited objects for attacker-controlled language keys, allowing properties to be written to Object.prototype.

In the joi library, there is a vulnerability in the internals.rename() implementation used by object().rename(). It allows creating a schema that, using a regular expression and a Joi.expression() or Joi.x() target with match data interpolation, can set the prototype of the object returned by validate() to __proto__ instead of creating an own key.

A vulnerability in the joi library (versions before 17.13.4 and 18.2.1) allows a DoS attack by sending deeply nested JSON or objects with recursive link() schemas. Calling validate() without try/catch in a request handler can cause an unhandled RangeError and potentially crash the process.