Joi EUVD-2026-113320

Exploitation requires the application to validate attacker-controlled input with the Joi.string().email({ multiple: true }) rule and to lack an effective length limit before the email rule executes. The flaw applies to the default ',' separator and to every custom separator. Key limiting factors: applications that do not use the multiple option are unaffected; adding .max() before .email() (e.g. Joi.string().max(1000).email({ multiple: true })) blocks long values first, but ONLY when abortEarly:false is not in use - with abortEarly:false the email rule still runs after the max check fails, so that configuration remains exploitable. A .trim() rule is explicitly NOT a sufficient workaround because it strips only leading/trailing whitespace. No authentication or user interaction is needed when the validating route is public (PR:N, UI:N).

This is a credible, moderate-urgency availability risk rather than a high-CVSS-but-low-real-risk issue, but its reach is narrower than the raw 7.5 score suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures a remote, unauthenticated, low-complexity denial of service with no confidentiality or integrity impact - consistent with the CWE-1333 inefficient-regex classification. The vuln.today decision label is 'this_week', which aligns with a real but non-emergency DoS. The signals are internally consistent: the GHSA advisory provides concrete timing evidence (100 KB of spaces blocks the event loop for ~3.3 seconds, 200 KB for ~13.6 seconds), confirming the A:H claim. No EPSS score and no CISA KEV entry were supplied, and there is no indication of active exploitation - so this should be treated as 'no public active exploitation reported' while noting that a working reproducer is published in the advisory. The important qualifier the CVSS vector cannot express is conditionality: exploitation only matters for applications that actually call Joi.string().email({ multiple: true }) on attacker-controlled input without an effective prior length limit. For the large subset of joi users who do not use the multiple email option, real-world risk is effectively zero despite the network-exploitable rating.

An attacker sends a single HTTP request to a public endpoint (for example POST /invite) whose body field is validated by Joi.string().email({ multiple: true }), placing roughly 100 KB of whitespace with no separator in that field. The quadratic split blocks the Node.js event loop for several seconds, and a small number of concurrent requests keeps the single-threaded server unable to serve any other traffic. A working proof-of-concept reproducer is published in the GHSA advisory, demonstrating the timing blow-up on joi 18.3.0.