hapijs joi vulnerabilities

Newest CVEs

• CVE-2026-122131

  Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

  hapijs · joi

  Medium6.3
• CVE-2026-118772

  joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

  hapijs · joi

  High7.5
• CVE-2026-92599

  Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

  hapijs · joi

  High8.7
• CVE-2026-90771

  joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

  hapijs · joi

  Medium6.3
• CVE-2026-84368

  joi: Prototype pollution via a `__proto__` language key in custom messages

  hapijs · joi

  Low3.7
• CVE-2026-84367

  joi: object().rename() with a template target can set the validated object's prototype

  hapijs · joi

  Low3.7
• CVE-2026-48038

  joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas

  hapijs · joi

  Medium5.3