EUVD-2026-69648

joi: object.rename with a template target can set the validated object's prototype...

NPM: joi: object().rename() with a template target can set the validated object's prototype

NPM: joi: object.rename with a template target can set the validated object's prototype vulnerability discovered by ? in WordPress Npm joi versions = 16.0.0, 17.13.5...

CVE-2026-84367

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

CVE-2026-84367

joi (a JavaScript schema validator) is vulnerable to a limited prototype pollution via object().rename() in versions 16.0.0 through 17.13.4 and 18.2.3 . The root cause lies in internals.rename() in lib/types/keys.js: when a schema uses a regular-expression source combined with a Joi.expression() ...

PT-2026-84505

Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.4 joi versions 18.0.0 through 18.2.3 Description The internals.rename implementation in lib/types/keys.js, used by object.rename, allows a schema to rename keys using a regular-expression source and a...