CVE-2026-84367

Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.4 joi versions 18.0.0 through 18.2.3

Description The internals.rename() implementation in lib/types/keys.js, used by object().rename(), allows a schema to rename keys using a regular-expression source and a Joi.expression() or Joi.x() target that interpolates match data when { multiple: true } is enabled. This can allow an attacker to provide a crafted input key, such as x- proto , causing the target to be rendered as proto. This results in the prototype of the object returned by validate() being set instead of creating a new own key. The effect is limited to the object returned by that specific validation call and does not modify the global Object.prototype. Schemas using static-string targets or the default { multiple: false } are not affected.

Recommendations Update to version 17.13.5. Update to version 18.2.4.