Skip to content
OpenAdvisories

Package · npm

joi

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-118772

    joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

    joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position …

    hapijs @hapi joi joi Wolfi npm
  • High 7.5
    CVE-2026-92599

    Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

    joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored…

    hapijs joi opensearch-dashboards-3 thingsboard-tb-js-executor Wolfi npm