CVE-2026-84367

Received Received - Intake

Prototype Pollution in Joi JavaScript Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84367

Affected Vendors & Products

Vendor	Product	Version / Range
hapijs	joi	From 16.0.0 (inc) to 17.13.5 (exc)
hapijs	joi	17.13.5
hapijs	joi	18.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability affects the joi library, a JavaScript schema validator. It allows an attacker to manipulate object keys using regular expressions and prototype pollution via the rename() function. When combined with specific settings, an attacker can set the prototype of an object returned by validation, potentially altering its behavior.

Detection Guidance

This vulnerability affects joi versions between 16.0.0 and 17.13.5 or 18.2.4. To detect it, check the installed joi version using commands like 'npm list joi' or 'npm ls joi'. If the version is within the affected range, update to 17.13.5 or 18.2.4 or later.

Impact Analysis

An attacker could exploit this to alter the prototype of objects during validation, leading to unexpected behavior in your application. This might cause security bypasses, data corruption, or application crashes. The impact is limited to the validated object and does not modify the global Object.prototype.

Compliance Impact

This vulnerability could lead to data integrity issues or unauthorized access, which may violate compliance requirements like GDPR (data protection) or HIPAA (healthcare data). Organizations using affected joi versions should update to patched versions to maintain compliance.

Mitigation Strategies

Immediately upgrade joi to version 17.13.5 or 18.2.4 or later to patch the vulnerability. Avoid using object().rename() with attacker-controlled input keys and { multiple: true } settings.

Hi! I’m here to help you understand CVE-2026-84367. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70