joi: object().rename() with a template target can set the validated object's prototype
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hapijs | joi | 16.0.0 to before 17.13.5; 18.0.0 to before 18.2.4 | 17.13.5, 18.2.4 | Patch available | CNA |
| — | joi (npm) | 16.0.0 to before 17.13.5 | 17.13.5 | Patch available | GHSA-gg4h-3hg2-grpc |
| — | joi (npm) | 18.0.0 to before 18.2.4 | 18.2.4 | Patch available | GHSA-gg4h-3hg2-grpc |
- joi Vendorhapijs Affected 16.0.0 to before 17.13.5; 18.0.0 to before 18.2.4 Fixed in 17.13.5, 18.2.4 Patch available CNA
- joi (npm) Vendor— Affected 16.0.0 to before 17.13.5 Fixed in 17.13.5 Patch available GHSA-gg4h-3hg2-grpc
- joi (npm) Vendor— Affected 18.0.0 to before 18.2.4 Fixed in 18.2.4 Patch available GHSA-gg4h-3hg2-grpc
Remediation
- Fix · CNA joi (hapijs) Fixed in 17.13.5, 18.2.4
- Fix · GHSA-gg4h-3hg2-grpc joi (npm) Fixed in 17.13.5 Advisory →
- Fix · GHSA-gg4h-3hg2-grpc joi (npm) Fixed in 18.2.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Not affected: 6 products
- Red Hat Build of Podman Desktop
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84367
- 2026-10-03 Alias added: GHSA-gg4h-3hg2-grpc
- 2026-10-09 Affected versions changed · Red Hat
- 2026-11-07 Affected versions changed · Red Hat
References
Other 8
- https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc
- https://github.com/hapijs/joi/pull/3134
- https://github.com/hapijs/joi/pull/3135
- https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6
- https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01
- https://github.com/hapijs/joi
- https://github.com/hapijs/joi/releases/tag/v17.13.5
- https://github.com/hapijs/joi/releases/tag/v18.2.4
More hapijs vulnerabilities
- TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
- TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
- TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
- TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
Sources
- CVE-2026-84367 · CVE Program
- CVE-2026-84367 · NVD
- FIRST EPSS
- GHSA-gg4h-3hg2-grpc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84367 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences