Skip to main content

Joi CVE-2026-90771

| EUVDEUVD-2026-76992 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-09-13 VulnCheck GHSA-wr44-6hxh-3jwq
Information Disclosure Prototype Pollution Joi Hapijs
6.3
CVSS 4.0 · Vendor: VulnCheck
View

Vulnerability Assessment

Weakness
CWE
CWE-1321
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 13, 2026

Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying __proto__ as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to .messages() or .prefs({ messages: ... }) can have downstream code silently broken when it relies on standard Object.prototype methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.

Affected VersionsENISA

joi 16.0.0 <17.13.8
joi 18.0.0 <18.2.9

Affected Packages

npm joi fix: 17.13.8, 18.2.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Joi gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat 5.9 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 77 npm packages depend on joi (32 direct, 45 indirect)

Ecosystem-wide dependent count for version 18.0.0.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Joi

View all
CVE-2026-118772 HIGH POC
7.5 Oct 29

Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0
CVE-2026-84367 LOW
3.7 Sep 01

Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of t
CVE-2026-84368 LOW
3.7 Sep 01

Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2021-23450 CRITICAL POC
9.8
CVE-2024-56059 CRITICAL
9.8
CVE-2021-23383 CRITICAL POC
9.8
CVE-2020-7788 CRITICAL POC
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Not-Affected

References

Advisories & patches
PATCH https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb ADVISORY https://access.redhat.com/errata/RHSA-2026:67573 ADVISORY https://access.redhat.com/errata/RHSA-2026:67605 ADVISORY https://access.redhat.com/errata/RHSA-2026:67610 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90771 REF https://github.com/hapijs/joi REF https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js REF https://github.com/hapijs/joi/issues/3150 REF https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy