joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Priority MEDIUM 61CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 11 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Partial joi (hapijs): 17.13.8, 18.2.9joi (npm): 17.13.8, 18.2.9Red Hat: 3 advisoriesRed Hat: 1 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| hapijs | joi | 16.0.0 to before 17.13.8; 18.0.0 to before 18.2.9 | 17.13.8, 18.2.9 | Patch available | CNA |
| — | joi (npm) | before 17.13.8 | 17.13.8 | Patch available | GHSA-wr44-6hxh-3jwq |
| — | joi (npm) | 18.0.0 to before 18.2.9 | 18.2.9 | Patch available | GHSA-wr44-6hxh-3jwq |
- joi Vendorhapijs Affected 16.0.0 to before 17.13.8; 18.0.0 to before 18.2.9 Fixed in 17.13.8, 18.2.9 Patch available CNA
- joi (npm) Vendor— Affected before 17.13.8 Fixed in 17.13.8 Patch available GHSA-wr44-6hxh-3jwq
- joi (npm) Vendor— Affected 18.0.0 to before 18.2.9 Fixed in 18.2.9 Patch available GHSA-wr44-6hxh-3jwq
Remediation
- Fix · CNA joi (hapijs) Fixed in 17.13.8, 18.2.9
- Fix · GHSA-wr44-6hxh-3jwq joi (npm) Fixed in 17.13.8 Advisory →
- Fix · GHSA-wr44-6hxh-3jwq joi (npm) Fixed in 18.2.9 Advisory →
Red Hat 3 advisories
- RHSA-2026:67610 Released 2026-09-15 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grafana12.4-12.4.10-0.3.hum1@aarch64, grafana12.4-12.4.10-0.3.hum1@src, grafana12.4-12.4.10-0.3.hum1@x86_64
- RHSA-2026:67605 Released 2026-09-15 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.2-13.2.1-0.4.hum1@aarch64, grafana13.2-13.2.1-0.4.hum1@src, grafana13.2-13.2.1-0.4.hum1@x86_64
- RHSA-2026:67573 Released 2026-09-15 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.3-0.9.hum1@aarch64, grafana13.1-13.1.3-0.9.hum1@src, grafana13.1-13.1.3-0.9.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:67573, RHSA-2026:67605, RHSA-2026:67610 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-90771
- 2026-10-03 Alias added: GHSA-wr44-6hxh-3jwq
- 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-wr44-6hxh-3jwq
- 2026-10-06 CVSS score added · GHSA-wr44-6hxh-3jwq
- 2026-10-06 Weakness changed · GHSA-wr44-6hxh-3jwq
- 2026-10-06 10 new references · GHSA-wr44-6hxh-3jwq
- 2026-11-06 Affected versions changed · Red Hat
References
Other 8
- GitHub Issue #3150
- https://github.com/hapijs/joi
- https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
- https://github.com/hapijs/joi/pull/3151
- https://github.com/hapijs/joi/pull/3153
- https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2
- https://github.com/hapijs/joi/releases/tag/v17.13.8
- https://github.com/hapijs/joi/releases/tag/v18.2.9
More hapijs vulnerabilities
- TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
- TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
- TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
- TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
- TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
- TI-2026-27366 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing CVSS 4.0HIGH 8.7
Sources
- CVE-2026-90771 · CVE Program
- CVE-2026-90771 · NVD
- FIRST EPSS
- GHSA-wr44-6hxh-3jwq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-90771 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences