CVE-2026-122131
lowJoi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject…
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/hapijs/joi disclosure@vulncheck.com
- https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67 disclosure@vulncheck.com
- https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6 disclosure@vulncheck.com
- https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec disclosure@vulncheck.com
- https://github.com/hapijs/joi/pull/3164 disclosure@vulncheck.com
- https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-p... disclosure@vulncheck.com