Skip to content
OpenAdvisories

Package · npm

@hapi/joi

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.7
    CVE-2026-122131

    Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

    Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), …

    hapijs joi joi @hapi/joi npm
  • High 7.5
    CVE-2026-118772

    joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

    joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position …

    hapijs @hapi joi joi Wolfi npm