ROOT-APP-NPM-CVE-2026-118772 CVE-2026-118772 in joi - Patched by Root

Root has patched CVE-2026-118772 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-90771 CVE-2026-90771 in joi - Patched by Root

Root has patched CVE-2026-90771 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-92599 CVE-2026-92599 in joi - Patched by Root

Root has patched CVE-2026-92599 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84368 CVE-2026-84368 in joi - Patched by Root

Root has patched CVE-2026-84368 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-6H2X-M376-MQJQ GHSA-6h2x-m376-mqjq in joi - Patched by Root

Root has patched GHSA-6h2x-m376-mqjq in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84367 CVE-2026-84367 in joi - Patched by Root

Root has patched CVE-2026-84367 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48038 CVE-2026-48038 in joi - Patched by Root

Root has patched CVE-2026-48038 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-912310 AIKIDO-2026-912310 in joi - Patched by Root

Root has patched AIKIDO-2026-912310 in the joi package for Root:npm. Multiple fixed versions available...

CLSA-2026-1794316825 TuxCare security update for @hapi/joi (1 CVE)

TuxCare rebuilt @hapi/joi to address 1 CVE. Fixed in 17.1.1-tuxcare.2...

CLSA-2026-1794314062 TuxCare security update for @hapi/joi (1 CVE)

TuxCare rebuilt @hapi/joi to address 1 CVE. Fixed in 17.1.1-tuxcare.1...

CVE-2026-122131

A flaw was found in joi. Applications that pass untrusted input into custom message configuration functions allow an attacker to cause prototype pollution, where shared base object properties in the runtime environment are improperly altered. By supplying a specially crafted message configuration...

joi: joi: Denial of Service via inefficient regular expression in email validation

A flaw was found in joi. The email validation rule configured to validate multiple addresses uses an inefficient regular expression when splitting input strings. A remote attacker can exploit this flaw by submitting input containing long runs of whitespace, causing excessive computation. This can...

joi: joi: Denial of Service via inefficient regular expression in email validation

A flaw was found in joi. The email validation rule configured to validate multiple addresses uses an inefficient regular expression when splitting input strings. A remote attacker can exploit this flaw by submitting input containing long runs of whitespace, causing excessive computation. This can...

CVE-2026-122131

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122131 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122131 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122131

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

EUVD-2026-117085

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122131 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-122131

The Joi library versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 are vulnerable to a prototype pollution vulnerability. The flaw exists in the lib/messages.js file within the compile() and merge() functions, which fail to reject the __proto__ language key. An attacker providing untrusted ...