hapijs joi CVE-2026-48038

Exploitation requires that the application defines at least one joi schema using the link() type for recursive structure validation (e.g., Joi.object({ a: Joi.link('/') })). The targeted endpoint must accept user-controlled JSON that reaches that schema's validate() or validateAsync() call. Process crash (highest impact) further requires that the validation call is NOT wrapped in a try/catch - a common omission in request handlers. Applications not using recursive link() schemas are entirely unaffected regardless of their joi version. Non-recursive joi schema usage (strings, numbers, objects without link()) is not vulnerable. No authentication, no specific platform, and no non-default configuration beyond recursive link() schema usage is required to trigger the RangeError.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) scores 5.3, reflecting medium severity. However, the A:L assignment appears conservative: when validate() is called without a try/catch in a request handler - a common real-world pattern - the uncaught RangeError crashes the entire Node.js process, constituting complete availability loss (A:H) of the service for all users, not just the requester. An independent assessment of A:H yields CVSS 7.5. This discrepancy should be noted by defenders when prioritizing. No EPSS data was provided, and the CVE is not listed in CISA KEV, indicating no confirmed widespread or active exploitation. No public exploit code (POC) has been identified, though the attack is trivially constructable - any nested JSON object with thousands of levels is sufficient. The practical blast radius is bounded by the specific use of joi's link() schema for recursive validation; applications using joi without recursive link schemas are completely unaffected.

An unauthenticated attacker sends a single HTTP POST request to an API endpoint that accepts JSON and validates it with a joi schema containing a recursive link() definition. The payload is a JSON object nested 5,000 or more levels deep (e.g., {a:{a:{a:...}}}). If the endpoint's validation code does not wrap schema.validate() in a try/catch, the resulting RangeError is unhandled, crashing the Node.js process and taking the service offline for all users. No public exploit code is needed - the payload is trivially generated with a simple loop.