{"id":"CVE-2026-84368","aliases":["GHSA-6w3j-5fw6-r9vr"],"url":"https://o3.security/vulnerability/CVE-2026-84368","summary":"joi: Prototype pollution via a `__proto__` language key in custom messages","details":"### Impact\nAn application that passes attacker-controlled data into joi's custom message configuration (`messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`) lets the attacker write properties onto `Object.prototype`, where every object in the process then inherits them. A key named `__proto__` was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named `constructor` did the same to the `Object` function's statics. A consuming application that gates on the mere presence of a property (`if (user.isAdmin)`) can be made to take the wrong branch for every object it inspects.\n\nThis is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.\n\n### Patches\nUpgrade to version 18.2.5 or 17.13.6.\n\n### Workarounds\nDo not pass untrusted input into `messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`. Or validate that they don't contain any `__proto__` or `constructor` property.","published":"2026-09-01T20:36:51.859Z","modified":"2026-10-21T03:00:29.241866064Z","cvss":{"score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"joi","fixedVersion":"17.13.6"},{"ecosystem":"npm","name":"@hapi/joi","fixedVersion":null},{"ecosystem":"npm","name":"joi","fixedVersion":"18.2.5"}],"fix":{"url":"https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","label":"hapijs/joi@8d0b808"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84368.json"},{"type":"ADVISORY","url":"https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84368"},{"type":"FIX","url":"https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"},{"type":"FIX","url":"https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"},{"type":"FIX","url":"https://github.com/hapijs/joi/pull/3138"},{"type":"FIX","url":"https://github.com/hapijs/joi/pull/3139"},{"type":"PACKAGE","url":"https://github.com/hapijs/joi"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:29.241866064Z"}}