Read the docs
TI-2026-82716 Aliases CVE-2026-118772GHSA-4528-x5fx-h6hg

Quadratic-time split in joi email rule allows denial of service

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

The joi schema validator for JavaScript is affected in versions from 16.0.0 through 17.1.1, from 17.1.1 before 17.13.9, and from 18.0.0 before 18.3.1. The string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier causes quadratic work (CWE-1333) on long whitespace runs during String.prototype.split. An attacker who controls a validated value can block the Node.js event loop for seconds with one request when the application has no effective prior length limit, because a .max() rule does not stop the email rule from running when abortEarly is false.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Partial joi (hapijs): 18.3.1joi (npm): 17.13.9, 18.3.1Red Hat: 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapijsjoi16.0.0 – 17.1.1; 18.0.0 to before 18.3.118.3.1Patch availableCNA
@hapijoi16.0.0 – 17.1.1—No fix listedCNA
—joi (npm)17.1.1 to before 17.13.917.13.9Patch availableGHSA-4528-x5fx-h6hg
—@hapi/joi (npm)16.0.0 – 17.1.1—No fix listedGHSA-4528-x5fx-h6hg
—joi (npm)18.0.0 to before 18.3.118.3.1Patch availableGHSA-4528-x5fx-h6hg
  • joi Vendorhapijs Affected 16.0.0 – 17.1.1; 18.0.0 to before 18.3.1 Fixed in 18.3.1 Patch available CNA
  • joi Vendor@hapi Affected 16.0.0 – 17.1.1 Fixed in — No fix listed CNA
  • joi (npm) Vendor— Affected 17.1.1 to before 17.13.9 Fixed in 17.13.9 Patch available GHSA-4528-x5fx-h6hg
  • @hapi/joi (npm) Vendor— Affected 16.0.0 – 17.1.1 Fixed in — No fix listed GHSA-4528-x5fx-h6hg
  • joi (npm) Vendor— Affected 18.0.0 to before 18.3.1 Fixed in 18.3.1 Patch available GHSA-4528-x5fx-h6hg

Remediation

Upgrade joi to version 17.13.9 or 18.3.1. The sources list no fixed version for @hapi/joi. Red Hat lists no available fix plan for Cryostat 4, Migration Toolkit for Containers, OpenShift Serverless, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA joi (hapijs) Fixed in 18.3.1
  • Fix · GHSA-4528-x5fx-h6hg joi (npm) Fixed in 17.13.9 Advisory →
  • Fix · GHSA-4528-x5fx-h6hg joi (npm) Fixed in 18.3.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
Migration Toolkit for ContainersAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Not affected: 3 products
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-118772
  2. 2026-10-30 Affected versions changed · Red Hat
  3. 2026-10-30 CVSS score added · Red Hat
  4. 2026-10-30 Alias added: GHSA-4528-x5fx-h6hg
  5. 2026-10-30 Fix available: npm/[email protected], npm/[email protected] · GHSA-4528-x5fx-h6hg
  6. 2026-10-30 CVSS score added · GHSA-4528-x5fx-h6hg
  7. 2026-10-30 Weakness changed · GHSA-4528-x5fx-h6hg
  8. 2026-10-30 9 new references · GHSA-4528-x5fx-h6hg
  9. 2026-10-31 Priority changed: MEDIUM → LOW
  10. 2026-10-31 Affected versions changed · Red Hat
  11. 2026-11-04 Affected versions changed · Red Hat
  12. 2026-11-04 CISA SSVC decision points changed
  13. 2026-11-04 Priority changed: LOW → HIGH
  14. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 8

  • TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
  • TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
  • TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
  • TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
  • TI-2026-27366 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing CVSS 4.0HIGH 8.7
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences