Schema Description Language Vulnerability in JOI by Hapi
CVE-2026-118772
What is CVE-2026-118772?
The JOI library, which facilitates schema description and data validation for JavaScript, is vulnerable in specific versions to a Denial of Service attack. When utilizing the Joi.string().email({ multiple: true }) rule, the implementation can inadvertently lead to significant performance degradation. This issue arises from a problematic regular expression that causes excessive processing time when parsing long whitespace sequences without separators. As a result, attackers can exploit this behavior by submitting controlled input, potentially blocking the Node.js event loop for prolonged periods and impacting the overall application performance. Users are advised to upgrade their JOI library to versions 17.13.9 or 18.3.1 to mitigate this issue.
Affected Version(s)
joi >= 16.0.0, <= 17.1.1 <= 16.0.0, 17.1.1
joi >= 18.0.0, < 18.3.1 < 18.0.0, 18.3.1
joi >= 16.0.0, <= 17.1.1