Read the docs
TI-2026-85172 Aliases CVE-2026-122131GHSA-gw37-7cc7-xmm6

Joi prototype replacement via __proto__ language key

Priority LOW 28CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Joi from 17.13.6 before 17.13.9 and from 18.2.5 before 18.3.1 contains a prototype pollution flaw in lib/messages.js, where compile() and merge() fail to reject a __proto__ language key. An unauthenticated remote attacker who can supply untrusted message configuration through any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype. This alters or breaks validation error rendering and dependent logic. The weakness is classified as CWE-1321.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed joi (hapijs): 17.13.9, 18.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hapijsjoi17.13.6 to before 17.13.9; 18.2.5 to before 18.3.117.13.9, 18.3.1Patch availableCNA
  • joi Vendorhapijs Affected 17.13.6 to before 17.13.9; 18.2.5 to before 18.3.1 Fixed in 17.13.9, 18.3.1 Patch available CNA

Remediation

Upgrade hapijs Joi to 17.13.9 or 18.3.1, the fixed versions for the 17 and 18 branches.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA joi (hapijs) Fixed in 17.13.9, 18.3.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122131
  2. 2026-11-04 Alias added: GHSA-gw37-7cc7-xmm6
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-07 Affected versions changed · Red Hat
  6. 2026-11-07 CVSS score added · Red Hat

References

Patch 3

Advisory 1

Other 2

  • TI-2026-82752 Quadratic-time parsing in @hapi/content allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-82716 Quadratic-time split in joi email rule allows denial of service CVSS 3.1HIGH 7.5
  • TI-2026-61678 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CVSS 4.0MEDIUM 6.3
  • TI-2018-02726 Prototype pollution in @hapi hoek node module CVSS 3.0HIGH 8.8
  • TI-2026-79747 Regular expression denial of service in @hapi/content disposition parsing CVSS 4.0HIGH 8.7
  • TI-2026-62455 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CVSS 4.0HIGH 8.7
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences