CVE-2026-92599

Name of the Vulnerable Software and Affected Versions joi versions 17.2.0 through 17.13.6 joi versions 18.0.0 through 18.2.5

Description A regular expression denial of service exists in the Joi.string().isoDate() validation rule. An unanchored regular expression causes the engine to restart its search from every position in the string when a valid ISO date is followed by a long sequence of fractional-second digits. This results in processing time proportional to the square of the input length, allowing a remote attacker to stall the application with a single request.

Recommendations Update joi versions 17.2.0 through 17.13.6 to version 17.13.7. Update joi versions 18.0.0 through 18.2.5 to version 18.2.6. As a temporary workaround, cap the length of the string before it reaches joi.