Key Renaming Vulnerability in joi Schema Validator by Hapi.js
CVE-2026-84367
3.7LOW
What is CVE-2026-84367?
The joi library for JavaScript has a vulnerability within its key renaming functionality, where specific regex patterns can be exploited. When using object().rename() with an attacker-controlled input key, there is a risk that the object returned by the validate() function may wrongly set its prototype via the proto property. This could lead to unintended behavior in the application, as prototype manipulation can enable bypassing of security controls. The issue is resolved in versions 17.13.5 and 18.2.4, making upgrades essential to ensure application integrity.
Affected Version(s)
joi >= 16.0.0, < 17.13.5 < 16.0.0, 17.13.5
joi >= 18.0.0, < 18.2.4 < 18.0.0, 18.2.4