EUVD-2026-69649

joi: Prototype pollution via a proto language key in custom messages...

20yearrewards (>=1.0.7, <=1.0.8), 3id-test-helper (>=1.0.0, <=1.0.4) +2601 more potentially affected by CVE-2026-84368 via @hapi/joi (>=16.0.0, <=17.1.1)

@hapi/joi NPM version =16.0.0, =1.0.7, =1.0.0, =0.24.0, =2.0.2, =6.8.2, =1.4.0, =3.1.0, =3.2.0, =1.8.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =4.0.0-beta.2 and more Source cves: CVE-2026-84368 Source advisory: OSV:GHSA-6W3J-5FW6-R9VR...

SUSE CVE-2026-84368

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

Linux Distros Unpatched Vulnerability : CVE-2026-84368

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the...

CVE-2026-84368

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile and exports.merge reuse inherited objects for...

CVE-2026-84368

joi (and its predecessor @hapi/joi ), a JavaScript schema validator, is affected by a prototype pollution vulnerability in lib/messages.js. The functions exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys (e.g., __proto__ or constructor), which can...