CVE-2026-84368

The record

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.

Affected packages

Related vulnerabilities

• CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-1321
• CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
• CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
• CVE-2026-104183 stream-json is a micro-library of stream components for processing JSON and JSONC with a… CWE-1321
• CVE-2026-102992 piscina is a node.js worker pool implementation. CWE-1321
• CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
• CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
• CVE-2026-101902 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321