Joi EUVD-2026-81299

The application must invoke the Joi.string().isoDate() validation rule on attacker-controllable input AND must NOT cap the input string length before it reaches joi. Because the algorithm is quadratic rather than exponential, the attacker must be able to send large strings (roughly 64KB for ~1.4s and 256KB for ~22s of stall), so any upstream body-size or field-length limit materially reduces or neutralizes the impact. No authentication is required (PR:N) and no user interaction is needed (UI:N); the limiting factors are the presence of an isoDate() rule on a reachable endpoint and the absence of a length cap. Workaround: cap the string length before it reaches joi, or upgrade to 17.13.7 / 18.2.6.

Signals are consistent and point to a genuine but bounded availability risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, VC:N/VI:N) correctly frames this as a network-reachable, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact - the 8.7 score is driven entirely by high availability impact. CWE-1333 (ReDoS) matches the described unanchored-regex quadratic blowup. Importantly, the algorithmic complexity here is QUADRATIC (O(n²)), not exponential: the description quantifies ~1.4s for 64KB and ~22s for 256KB of input, so a single small request cannot stall the app - an attacker needs to submit large (tens-to-hundreds of KB) strings, and sustained impact requires repeated large requests. No EPSS score, no KEV listing, and no POC are present in the input, so there is no evidence of active exploitation; treat this as 'no public exploit identified.' Net: a real, easily-triggered DoS in a hugely popular library, worth prompt patching, but the raw 8.7 overstates single-request severity because the attack is throughput/size-dependent rather than an instant crash, and real-world exposure hinges on whether an isoDate() rule is actually reachable with uncapped input.

An attacker identifies an HTTP/API endpoint whose request body or parameter is validated with Joi.string().isoDate() (common in hapi.js and Express request schemas). They submit a payload consisting of a valid ISO date followed by a very long run of fractional-second digits (e.g., 256KB), causing the unanchored regex to rescan from every position and pin a CPU/event-loop thread for many seconds. Repeating such requests exhausts the single-threaded Node.js event loop and stalls the service for all users. No public exploit code is identified in the provided sources.