CVE-2026-84368

Received Received - Intake

Prototype Pollution in joi JavaScript Library

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84368

Affected Vendors & Products

Vendor	Product	Version / Range
hapi	joi	From 16.0.0 (inc) to 17.13.6 (inc)
hapi	joi	to 17.1.1 (inc)
hapi	joi	to 18.2.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability is a prototype pollution issue in the joi JavaScript library versions between 16.0.0 and 17.13.6 or 18.2.5. It occurs in lib/messages.js where functions like exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys. An attacker can use keys like __proto__ or constructor to modify Object.prototype or Object function properties, potentially affecting how the application handles object properties.

Detection Guidance

This vulnerability is specific to applications using joi versions between 16.0.0 and 17.13.5 or 18.0.0 and 18.2.4. Check installed joi versions with npm list joi or grep -r 'joi' package.json files. Review application code for usage of joi.compile(), joi.extend(), or messages configuration with untrusted input.

Impact Analysis

If your application uses a vulnerable version of joi and processes untrusted input directly into schema-construction configuration, an attacker could manipulate object properties. This might cause your application to behave unexpectedly, such as taking incorrect code branches based on inherited properties, leading to logic errors or security bypasses.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it involves prototype pollution in schema construction configuration rather than data validation or exposure of sensitive information. Compliance risks would only arise if the application incorrectly processes data due to inherited properties from Object.prototype, potentially leading to logic errors.

Mitigation Strategies

Upgrade joi to version 17.13.6 or 18.2.5 or later. Audit application code for schema-construction configurations using untrusted input in messages, prefs, or Joi.extend calls. Remove or sanitize any use of __proto__ or constructor as language keys in messages.

Hi! I’m here to help you understand CVE-2026-84368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70