CVE-2026-122131

The Joi library versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 are vulnerable to a prototype pollution vulnerability. The flaw exists in the lib/messages.js file within the compile() and merge() functions, which fail to reject the __proto__ language key. An attacker providing untrusted ...