CVE-2026-84367 is a low-severity (CVSS 3.7) CWE-1321 vulnerability in joi. A fix is available for joi — see the affected versions and patch details below.
joi: object().rename() with a template target can set the validated object's prototype
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-84367.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-84367 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
joinpmDescription
Impact
Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-__proto__ with an object value and make the rename target render as __proto__, which sets the prototype of the object joi returns instead of creating a key on it. The global Object.prototype is not modified, so the effect is confined to the object returned by that one validate() call.
Schemas using a static string rename target are not affected, and neither are schemas left on the default { multiple: false }.
Patches
Versions 17.13.5 and 18.2.4 have been released to address the issue.
Workarounds
- Replace the template rename target with a static string target.
- Keep the template but make the capture unable to produce
__proto__, using a negative lookahead:.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true }) - Drop { multiple: true } from the rename, which stops the rename before the assignment.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | joi | ≥ 16.0.0&&< 17.13.5 | 17.13.5npm install joi@17.13.5 |
| 📦npm | joi | ≥ 18.0.0&&< 18.2.4 | 18.2.4npm install joi@18.2.4 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for joi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update joi to 17.13.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-84367 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-84367 in your dependencies?
Find it across npm, including transitive dependencies.