CVE-2026-84368

A flaw was found in joi. This vulnerability, known as prototype pollution, allows an attacker to inject properties into core JavaScript objects by supplying untrusted input directly into schema-construction configuration. Specifically, by using language keys like __proto__ or constructor in custom messages, an attacker can write properties onto Object.prototype or the Object function's static properties. This can lead to a consuming application taking incorrect execution paths, potentially altering its behavior in unexpected ways.

A flaw was found in joi, a data validation library for JavaScript. Prototype pollution exists in the message compilation and merging logic, where attacker-controlled language keys such as proto supplied through schema configuration methods can write properties onto Object.prototype. Exploitation requires an application to pass untrusted input directly into schema-construction configuration, not into validated data, making real-world impact limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to joi 17.13.6 or 18.2.5. As a workaround, ensure that only trusted, developer-controlled input is passed into joi schema configuration methods such as messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Do not pass user-supplied data directly into schema construction.