CVE-2026-84367

A flaw was found in joi. A remote attacker can alter the prototype of an object returned by validation by submitting specially crafted input keys. When an application configures dynamic key renaming based on regular expression patterns, the validator fails to properly restrict sensitive internal property names. This vulnerability allows untrusted input to influence object properties and application logic, potentially leading to unexpected application behavior.

This vulnerability is rated as having a Low impact because exploitation requires a specific, non-default schema configuration utilizing dynamic regular expression key renames that interpolate match data. Additionally, prototype modification is strictly limited to the individual object returned by the validation operation rather than poisoning the global Object prototype. In typical Red Hat deployments where this library is embedded within containerized dashboard applications, input validation schemas rarely implement dynamic renaming vulnerable to this vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.