{"id":"CVE-2026-90771","aliases":["GHSA-wr44-6hxh-3jwq"],"url":"https://o3.security/vulnerability/CVE-2026-90771","summary":"joi before 17.13.8 and 18.2.9 Prototype Pollution via messages","details":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","published":"2026-09-13T10:45:42.498Z","modified":"2026-10-21T03:00:08.984917157Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"joi","fixedVersion":"17.13.8"},{"ecosystem":"npm","name":"joi","fixedVersion":"18.2.9"}],"fix":{"url":"https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","label":"hapijs/joi@5b8333c"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90771.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages"},{"type":"REPORT","url":"https://github.com/hapijs/joi/issues/3150"},{"type":"FIX","url":"https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb"},{"type":"PACKAGE","url":"https://github.com/hapijs/joi"},{"type":"ARTICLE","url":"https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3151"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3153"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2"},{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v17.13.8"},{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v18.2.9"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:08.984917157Z"}}