joi EUVD-2026-69648

Exploitation requires ALL of the following conditions simultaneously in the joi schema: (1) object().rename() must use a regular-expression source pattern - not a static string; (2) the rename target must be a Joi.x() or Joi.expression() expression that interpolates regex capture groups, causing the rendered target to be derived from attacker-controlled input; and (3) the { multiple: true } option must be explicitly set, since the default is { multiple: false } which is not affected. Static string rename targets are never affected regardless of other options. The blast radius is further bounded: global Object.prototype is not modified - only the prototype of the specific object returned by that validate() call is affected. For any security-relevant outcome, downstream application code must also read a prototype-inherited property from the validated result rather than only its own enumerable properties.

The provided CVSS 3.7 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is well-calibrated and consistent with independent assessment. AC:H is justified: exploitation requires a schema that simultaneously uses a regex rename source, a Joi.x() or Joi.expression() interpolating template, and { multiple: true } - none of which is the default configuration. I:L is accurate because impact is confined to the prototype of the single validated object; requests to other routes and global prototype chains are unaffected. No EPSS score was provided in the input data, and no CISA KEV listing exists, consistent with the low base score. Real-world risk is low for most deployments. However, applications that use this exact non-default schema pattern and then evaluate prototype-inherited properties on the validated result - for example, authorization checks - could be exposed to within-request privilege escalation. Defenders should audit schemas rather than treat the low CVSS as universally dismissible.

An attacker submits a JSON body such as {"user":"alice","x-__proto__":{"isAdmin":true,"role":"superuser"}} to an API endpoint whose joi schema includes .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). The rename resolves the capture group to __proto__, setting the prototype of the returned value object to the attacker-supplied object. If the route handler subsequently checks value.isAdmin, the prototype-inherited property evaluates to true, potentially granting unauthorized access within that request. No public proof-of-concept beyond the in-repository test case introduced by the fix exists at time of analysis.