ROOT-APP-NPM-GHSA-6H2X-M376-MQJQ GHSA-6h2x-m376-mqjq in joi - Patched by Root

Root has patched GHSA-6h2x-m376-mqjq in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-92599 CVE-2026-92599 in joi - Patched by Root

Root has patched CVE-2026-92599 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84367 CVE-2026-84367 in joi - Patched by Root

Root has patched CVE-2026-84367 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48038 CVE-2026-48038 in joi - Patched by Root

Root has patched CVE-2026-48038 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-912310 AIKIDO-2026-912310 in joi - Patched by Root

Root has patched AIKIDO-2026-912310 in the joi package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84368 CVE-2026-84368 in joi - Patched by Root

Root has patched CVE-2026-84368 in the joi package for Root:npm. Multiple fixed versions available...

CLSA-2026-1791362244 TuxCare security update for @hapi/joi (1 CVE)

TuxCare rebuilt @hapi/joi to address 1 CVE. Fixed in 16.1.8-tuxcare.1...

CLSA-2026-1791278886 TuxCare security update for joi (1 CVE)

TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.2...

PT-2026-115935

TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.2...

Prototype Pollution

joi is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of proto keys during message compilation, which allows an attacker to manipulate the returned object's prototype and disrupt downstream code that relies on Object.prototype methods...

CLSA-2026-1790719586 TuxCare security update for joi (1 CVE)

TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.1...

NPM: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

NPM: joi: Quadratic regular-expression backtracking in Joi.string.isoDate vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.7...

@adatechnology/conversation-module (>=0.2.0, <=0.4.3), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +302 more potentially affected by CVE-2026-92599 via joi (>=18.0.0, <=18.2.5)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-92599 Source advisory: GHSA-6H2X-M376-MQJQ...

@adatechnology/conversation-module (>=0.2.0, <=0.4.3), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +302 more potentially affected by CVE-2026-92599 via joi (>=18.0.0, <=18.2.5)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-92599 Source advisory: OSV:GHSA-6H2X-M376-MQJQ...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1757 more potentially affected by CVE-2026-92599 via joi (>=17.2.0, <=17.13.6)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.8.31, =1.8.31, =1.8.31, =1.16.33-beta-20241105-141729-e4608175, =1.17.13-beta-20261019-013222-23d4b329 and more Source cves: CVE-2026-92599 Source advisory:...

GHSA-6H2X-M376-MQJQ joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1757 more potentially affected by CVE-2026-92599 via joi (>=17.2.0, <=17.13.6)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.8.31, =1.8.31, =1.8.31, =1.16.33-beta-20241105-141729-e4608175, =1.17.13-beta-20261019-013222-23d4b329 and more Source cves: CVE-2026-92599 Source advisory:...

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

CVE-2026-84367

A flaw was found in joi. A remote attacker can alter the prototype of an object returned by validation by submitting specially crafted input keys. When an application configures dynamic key renaming based on regular expression patterns, the validator fails to properly restrict sensitive internal...

Linux Distros Unpatched Vulnerability : CVE-2026-92599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. O...