joi: Prototype pollution via a `__proto__` language key in custom messages
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hapijs | joi | 16.0.0 – 17.1.1; 17.2.0 to before 17.13.6; 18.0.0 to before 18.2.5 | 17.13.6, 18.2.5 | Patch available | CNA |
| — | joi (npm) | 17.2.0 to before 17.13.6 | 17.13.6 | Patch available | GHSA-6w3j-5fw6-r9vr |
| — | @hapi/joi (npm) | 16.0.0 – 17.1.1 | — | No fix listed | GHSA-6w3j-5fw6-r9vr |
| — | joi (npm) | 18.0.0 to before 18.2.5 | 18.2.5 | Patch available | GHSA-6w3j-5fw6-r9vr |
- joi Vendorhapijs Affected 16.0.0 – 17.1.1; 17.2.0 to before 17.13.6; 18.0.0 to before 18.2.5 Fixed in 17.13.6, 18.2.5 Patch available CNA
- joi (npm) Vendor— Affected 17.2.0 to before 17.13.6 Fixed in 17.13.6 Patch available GHSA-6w3j-5fw6-r9vr
- @hapi/joi (npm) Vendor— Affected 16.0.0 – 17.1.1 Fixed in — No fix listed GHSA-6w3j-5fw6-r9vr
- joi (npm) Vendor— Affected 18.0.0 to before 18.2.5 Fixed in 18.2.5 Patch available GHSA-6w3j-5fw6-r9vr
Remediation
- Fix · CNA joi (hapijs) Fixed in 17.13.6, 18.2.5
- Fix · GHSA-6w3j-5fw6-r9vr joi (npm) Fixed in 17.13.6 Advisory →
- Fix · GHSA-6w3j-5fw6-r9vr joi (npm) Fixed in 18.2.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84368
- 2026-10-03 Alias added: GHSA-6w3j-5fw6-r9vr
- 2026-11-07 Affected versions changed · Red Hat
References
Other 6
- https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
- https://github.com/hapijs/joi/pull/3138
- https://github.com/hapijs/joi/pull/3139
- https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
- https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
- https://github.com/hapijs/joi
More hapijs vulnerabilities
- TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
- TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
- TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
- TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
Sources
- CVE-2026-84368 · CVE Program
- CVE-2026-84368 · NVD
- FIRST EPSS
- GHSA-6w3j-5fw6-r9vr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84368 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences