Prototype Pollution in joi Package for JavaScript Applications
CVE-2026-84368
What is CVE-2026-84368?
The joi package, a schema description language and data validator for JavaScript, contains a prototype pollution vulnerability in its lib/messages.js file. This flaw arises in specific versions of joi and enables attackers to manipulate inherited objects by supplying language keys that can exploit the exports.compile() and exports.merge() functions. Specifically, a malicious language key such as 'proto' could allow an attacker to write properties onto Object.prototype, affecting how consuming applications interpret inherited properties during schema validation. To mitigate this, users are urged to upgrade to fixed versions: joi 17.13.6 or 18.2.5, as no patched version for @hapi/joi is available.
Affected Version(s)
joi >= 16.0.0, <= 17.1.1 <= 16.0.0, 17.1.1
joi >= 17.2.0, < 17.13.6 < 17.2.0, 17.13.6
joi >= 18.0.0, < 18.2.5 < 18.0.0, 18.2.5