What’s Vulnerable › Products

hapijs joi vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your hapijs joi version is affected

Latest hapijs joi vulnerabilities

• CVE-2026-118772 — joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service (CVSS 7.5)
• CVE-2026-92599 — Joi before 17.13.7 and 18.2.6 ReDoS via isoDate (CVSS 7.5)
• CVE-2026-90771 — joi before 17.13.8 and 18.2.9 Prototype Pollution via messages (CVSS 3.7)
• CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages (CVSS 3.7)
• CVE-2026-84367 — joi: object().rename() with a template target can set the validated object's prototype (CVSS 3.7)
• CVE-2026-48038 — joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas (CVSS 5.3)