CVE-2026-122131

Name of the Vulnerable Software and Affected Versions Joi versions 17.13.6 through 17.13.8 Joi versions 18.2.5 through 18.3.0

Description Prototype pollution occurs in the compile() and merge() functions within lib/messages.js because the software fails to reject a proto language key. Attackers can provide untrusted message configuration through any().messages(), prefs, validate options, or Joi.extend to replace the compiled messages prototype. This can alter or break validation error rendering and dependent logic. If an application passes attacker-controlled data into custom message configurations—such as messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message })—the attacker can write properties onto Object.prototype. This allows every object in the process to inherit these properties, potentially causing the application to execute incorrect logic branches when checking for the presence of a property.

Recommendations Update Joi versions 17.13.6 through 17.13.8 to version 17.13.9. Update Joi versions 18.2.5 through 18.3.0 to version 18.3.1. Avoid passing untrusted input into messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Validate that input does not contain proto or constructor properties.