CVE-2026-90771

A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted __proto__ keys in custom messages. This allows the attacker to manipulate object properties, which could lead to unexpected application behavior or crashes.

A flaw in joi permits prototype manipulation when attacker-controlled JSON or configuration containing proto is supplied to the .messages() or .prefs() APIs, potentially disrupting downstream application behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade joi to 17.13.8, 18.2.9, or later. Avoid passing untrusted data to Joi message configuration until upgraded.