hapi joi vulnerabilities

Latest hapi joi CVEs

Newest publication first

1. CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

   Published 2026-10-29

   High·CVSS 7.5 EPSS 0.47%

   joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace...

2. CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages

   Published 2026-09-01

   Low·CVSS 3.7 EPSS 0.39%

   joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inher...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.