CVE-2026-92599

A flaw was found in joi. A remote attacker can exploit an unanchored regular expression in the Joi.string().isoDate() validation rule by supplying a specially crafted string. This input, consisting of a valid ISO date followed by a long sequence of fractional-second digits, causes the regular expression engine to consume excessive processing time. This vulnerability leads to a Regular Expression Denial of Service (ReDoS), allowing the attacker to stall the application with a single request.

This is an Important denial of service vulnerability as it can be exploited remotely without authentication. An unanchored regular expression in the isoDate validation rule of the joi library allows an attacker to provide a crafted input, leading to excessive resource consumption and application unresponsiveness. This can significantly impact the availability of services utilizing the vulnerable joi versions for ISO date validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, ensure that any input strings processed by the Joi.string().isoDate() validation rule are capped in length before being passed to the 'joi' package. This can prevent the regular expression engine from consuming excessive resources and causing a denial of service.