CVE-2026-84368

Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.5 joi versions 18.0.0 through 18.2.4 @hapi/joi versions 16.0.0 through 17.1.1

Description A prototype pollution issue exists in lib/messages.js where the exports.compile() and exports.merge() functions reuse inherited objects when processing attacker-controlled language keys. These keys can be supplied via messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Specifically, a language key named proto allows writing properties to Object.prototype, while constructor allows writing to the Object function's static properties. This can cause applications that rely on the presence of inherited properties to execute incorrect logic branches for all inspected objects. This flaw is only reachable if an application feeds untrusted input directly into the schema-construction configuration and cannot be triggered by data that joi validates.

Recommendations Update joi to version 17.13.6. Update joi to version 18.2.5. At the moment, there is no information about a newer version that contains a fix for this vulnerability for @hapi/joi.