Denial of Service Vulnerability in Joi Schema Validator by Hapi

CVE-2026-48038

What is CVE-2026-48038?

Joi, a schema description language and data validator for JavaScript, is susceptible to a denial of service due to untrapped exceptions in services validating user-supplied JSON or object input with recursive link() schemas. When the validate() function is invoked without appropriate try/catch error handling in a request handler, deeply nested input can cause an unhandled RangeError, leading to potential process crashes. This vulnerability has been addressed in Joi versions 17.13.4 and 18.2.1, which ensure that requests with problematic input are managed correctly to prevent application interruptions.

References