CVE-2026-118772

A flaw was found in joi. The email validation rule configured to validate multiple addresses uses an inefficient regular expression when splitting input strings. A remote attacker can exploit this flaw by submitting input containing long runs of whitespace, causing excessive computation. This can block the application's processing thread and lead to a Denial of Service (DoS).

This vulnerability is rated with an Important severity because an unauthenticated remote attacker can trigger severe CPU exhaustion, stalling the single-threaded Node.js event handling and causing a denial of service. Within Red Hat environments, the joi library is embedded across various web dashboards and containerized services for payload validation. Exploitation requires exposing an endpoint that processes untrusted data using multi-address email rules without restrictive payload length boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.