Joi
Monthly
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.
Joi, the JavaScript schema validation library published on npm as joi (17.1.1 through 17.13.8, and 18.0.0 through 18.3.0) and as @hapi/joi from 16.0.0 onward, takes quadratic time in String.prototype.split whenever the Joi.string().email({ multiple: true }) rule processes a value containing a long run of whitespace with no separator, allowing a single request to stall the Node.js event loop for seconds. The vendor advisory measures roughly 3.3 seconds for 100,000 spaces and 13.6 seconds for 200,000 spaces on joi@18.3.0, dropping to 0-1 ms after the fix; the root cause is CWE-1333 (inefficient regular expression complexity) and the impact is pure CPU-exhaustion denial of service with no confidentiality or integrity effect. Exploitation requires the application to validate untrusted input with the multiple option and to have no effective length limit before the email rule runs; remote, unauthenticated attackers can trigger it where such a route is public (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5). There is no CISA KEV entry and no confirmed active exploitation; the GitHub security advisory itself contains a proof-of-concept benchmark snippet, and the vulnerability is fixed in 17.13.9 and 18.3.1.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Prototype pollution in joi, one of the most widely used JavaScript schema-validation libraries (versions 16.0.0 through <17.13.6 and <18.2.5, and @hapi/joi through 17.1.1), allows an attacker who can supply attacker-controlled language keys to joi's schema-construction message API to write arbitrary properties onto Object.prototype or the Object constructor's static properties. A language key named __proto__ contaminates the global prototype, causing every subsequent property-existence check on any plain object in the process to return an unexpected value, silently flipping conditional logic. No public exploit has been identified at time of analysis, exploitation conditions are restrictive, and the vendor has released fixed versions 17.13.6 and 18.2.5.
Limited prototype pollution in joi's object().rename() allows unauthenticated remote attackers to set the prototype of the object returned by validate(), but does not affect global Object.prototype. When a schema combines a regex rename source, a Joi.x() or Joi.expression() interpolating template target, and { multiple: true }, an input key such as x-__proto__ causes the rename target to resolve to __proto__, which JavaScript interprets as a prototype assignment rather than own-property creation. The scope is strictly confined to the single validation call result - downstream code that reads prototype-inherited properties on that object could observe attacker-injected values, enabling potential within-request privilege escalation. No public exploit or CISA KEV listing exists at time of analysis; CVSS 3.7 (AC:H) accurately reflects the tight, non-default schema configuration required.