CVE-2026-48038

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Joi JavaScript Validation Library

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48038

Affected Vendors & Products

Vendor	Product	Version / Range
hapijs	joi	17.13.4
hapijs	joi	18.2.1
hapijs	joi	From 18.2.1 (inc) to 17.13.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

CVE-2026-48038 is a denial of service vulnerability in the joi JavaScript library. It occurs when user-supplied JSON or object input with recursive link() schemas triggers an untrapped exception during validation. Deeply nested input causes a RangeError due to maximum call stack overflow, potentially crashing the process if validate() is called without try/catch in a request handler.

Detection Guidance

To detect this vulnerability, check the version of joi in your project using npm list joi or grep -r "joi" package.json. If the version is below 17.13.4 or 18.2.1, the system is vulnerable. Test for recursive link() schemas by sending deeply nested JSON input to validation endpoints and monitoring for RangeError crashes or link.depth errors.

Impact Analysis

This vulnerability can crash your application if it processes deeply nested input without proper error handling. Even with try/catch, validation fails with a RangeError instead of a structured error, complicating error handling. The impact is higher when validate() is used without try/catch in request handlers.

Mitigation Strategies

Upgrade joi to version 17.13.4 or 18.2.1 or later immediately. As a temporary measure, wrap all joi validation calls in try/catch blocks to prevent uncaught exceptions. Set link.maxRecursion(limit) in schemas to bound validation depth and avoid stack overflow.

Hi! I’m here to help you understand CVE-2026-48038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70