11 matches found
CVE-2026-48038
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link schemas. When validate is called without try/catch in a reque...
CVE-2026-48038
Joi (JavaScript) vulnerability CVE-2026-48038: In versions prior to 17.13.4 and 18.2.1, validation of deeply nested user input via recursive link() schemas can trigger an unhandled RangeError when validate() runs without try/catch, potentially crashing the process. Fixed in 17.13.4 and 18.2.1. CV...
CVE-2026-48038 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link schemas. When validate is called without try/catch in a reque...
ROOT-APP-NPM-CVE-2026-48038 CVE-2026-48038 in @rootio/joi - Patched by Root
Root has patched CVE-2026-48038 in the @rootio/joi package for Root:npm. Multiple fixed versions available...
Uncaught Exception
Overview Affected versions of this package are vulnerable to Uncaught Exception through the link validation. An attacker can cause the application to crash or become unresponsive by submitting deeply nested input that triggers an unhandled RangeError exception. This is only exploitable if input...
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends on how the application invokes joi: - Highest impact: validate called without try/catch in a request handler would cause an unhandled...
GHSA-Q7CG-457F-VX79 joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends on how the application invokes joi: - Highest impact: validate called without try/catch in a request handler would cause an unhandled...
@ainsleydev/payload-helper (>=0.0.1 <=0.0.2), @bsct/payload (=1.0.0) +90 more potentially affected by CVE-2026-41690 via i18next-http-middleware (>=3.0.2 <=3.9.2)
i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0, =3.0.0, =1.0.0, =1.0.6, =1.0.0, =0.0.1, =0.0.229 and more Source cves: CVE-2026-41690 Source advisory: SNYK:JS-I18NEXTHTTPMIDDLEWARE-16415526...
EUVD-2025-140545
Malicious code in kupaio-kula-joi npm...
MAL-2025-175719 Malicious code in kupaio-kula-joi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector badcf6b31e2e9b2a5a34cf345f62d8338f114154c490de31af15c3f7e8a75da8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
