What’s Vulnerable › Vulnerabilities

CVE-2026-90771: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-13 · updated 2026-09-24
• Weakness: CWE-1321

Description

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Affected products

• hapijs joi: from 16.0.0 before 17.13.8; from 18.0.0 before 18.2.9 — fixed in 17.13.8, 18.2.9

How to fix

Upgrade to a fixed version: hapijs joi 17.13.8, 18.2.9. Check the vendor advisory for mitigations.

References

• https://github.com/hapijs/joi
• https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
• https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb
• https://github.com/hapijs/joi/issues/3150
• https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages
• https://github.com/hapijs/joi/issues/3150

Get alerted when CVE-2026-90771 or the next vulnerability affects your stack