CVE-2026-90771
Received Received - Intake

Prototype Pollution in Joi Validation Library

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulnCheck

Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90771
EUVD
EUVD-2026-76992

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hapijs joi From 16.0.0 (inc) to 17.13.8 (exc)
hapijs joi From 18.0.0 (inc) to 18.2.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a prototype pollution vulnerability in the joi library versions before 17.13.8 and 18.2.9. Attackers can supply __proto__ as an error code in custom messages, which replaces the returned object's prototype. This breaks downstream code relying on Object.prototype methods.

Detection Guidance

To detect this vulnerability, check if your system uses joi versions below 17.13.8 or 18.2.9. Run commands like 'npm list joi' or 'npm ls joi' to check installed versions. Inspect code for usage of the messages() function with user-controlled input.

Impact Analysis

It can break applications using joi that rely on Object.prototype methods. Attackers could manipulate object prototypes via malicious input in messages, leading to unexpected behavior or crashes in dependent code.

Mitigation Strategies

Immediately update joi to version 17.13.8 or 18.2.9 or later. If updating is not possible, review and sanitize all user inputs passed to the messages() function to prevent __proto__ injection. Remove any custom messages using __proto__ as a key.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart