CVE-2026-118772

Name of the Vulnerable Software and Affected Versions joi versions 17.1.1 through 17.13.8 joi versions 18.0.0 through 18.3.0

Description The Joi.string().email({ multiple: true }) rule uses a separator regular expression that causes quadratic work during String.prototype.split when processing long whitespace runs without a separator. This occurs with both default and custom separators. If an application validates attacker-controlled values using the multiple option without an effective length limit, a single request can block the Node.js event loop for several seconds. Note that a .max() rule is ineffective if abortEarly: false is configured, as the email rule may still execute after the length check fails.

Recommendations Update to version 17.13.9. Update to version 18.3.1.