p PatchFirst

CVE-2026-84368

CVE-2026-84368 · joi: Prototype pollution via a `__proto__` language key in custom messages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.

CVSS 3.7 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • joi

    Versions
    • >= 16.0.0, <= 17.1.1: Affected
    • >= 17.2.0, < 17.13.6: Affected
    • >= 18.0.0, < 18.2.5: Affected

    No fix published

  • joi npm

    Affected ranges
    • SEMVER: ≥ 17.2.0, < 17.13.6

    Update to 17.13.6

  • @hapi/joi npm

    Affected ranges
    • SEMVER: ≥ 16.0.0, ≤ 17.1.1

    No fix published

  • joi npm

    Affected ranges
    • SEMVER: ≥ 18.0.0, < 18.2.5

    Update to 18.2.5

Original sources

Check your server →