Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hapijs | joi | 16.0.0 – < 17.13.8, 18.0.0 – < 18.2.9 | 17.13.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.10-0.3.hum1 | RHSA-2026:67610 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.9.hum1 | RHSA-2026:67573 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.1-0.4.hum1 | RHSA-2026:67605 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | opensearch-dashboards-3 | 3.8.0-r11 | — |
| Wolfi rolling | thingsboard-tb-js-executor | 4.4-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | joi | < 17.13.8 | 17.13.8 | GHSA-wr44-6hxh-3jwq |
| npm | joi | >= 18.0.0, < 18.2.9 | 18.2.9 | GHSA-wr44-6hxh-3jwq |
Advisories 3
- RHSA-2026:67605 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67573 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67610 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
References
- GitHub Issue #3150 issue-tracking
- https://github.com/hapijs/joi product
- https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js technical-description
- https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb patch
- VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages third-party-advisory