Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-48038
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
- ❌ joi-17.13.3.tgz (Vulnerable Library)
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Publish Date: 2026-07-14
URL: CVE-2026-48038
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4
Step up your Open Source Security Game with Mend here
CVE-2026-84368
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
- ❌ joi-17.13.3.tgz (Vulnerable Library)
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named proto writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-09-01
URL: CVE-2026-84368
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-6w3j-5fw6-r9vr
Release Date: 2026-09-01
Fix Resolution: 17.13.6
Step up your Open Source Security Game with Mend here
CVE-2026-84367
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
- ❌ joi-17.13.3.tgz (Vulnerable Library)
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-proto with an object value, causing the target to render as proto and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-09-01
URL: CVE-2026-84367
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-gg4h-3hg2-grpc
Release Date: 2026-09-01
Fix Resolution: 17.13.5
Step up your Open Source Security Game with Mend here
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Publish Date: 2026-07-14
URL: CVE-2026-48038
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4
Step up your Open Source Security Game with Mend here
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named proto writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-09-01
URL: CVE-2026-84368
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-6w3j-5fw6-r9vr
Release Date: 2026-09-01
Fix Resolution: 17.13.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Sample Path to Dependency File: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-proto with an object value, causing the target to render as proto and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2026-09-01
URL: CVE-2026-84367
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-gg4h-3hg2-grpc
Release Date: 2026-09-01
Fix Resolution: 17.13.5
Step up your Open Source Security Game with Mend here