Prototype Pollution in Joi Product by Hapi
CVE-2026-90771

6.3MEDIUM

Key Information:

Vendor

Hapijs

Status
Joi
Vendor
CVE Published:
13 September 2026

What is CVE-2026-90771?

Joi, a popular data validation library, is vulnerable to prototype pollution due to its messages compilation function allowing the use of proto as an error code. Malicious users can exploit this by submitting custom messages that include proto keys, thereby altering the prototype of the returned object. This can result in the breaking of downstream code that relies on standard Object.prototype methods, potentially leading to unexpected behavior in applications utilizing the library for data validation.

Affected Version(s)

joi 16.0.0 < 17.13.8

joi 18.0.0 < 18.2.9

References

https://github.com/hapijs/joi/issues/3150
issue-tracking
https://github.com/hapijs/joi
product
https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.