Regular Expression Denial of Service in Joi Validation for hapi.js

CVE-2026-92599

What is CVE-2026-92599?

An issue has been identified in the Joi npm package, specifically within its isoDate validation rule. Versions of Joi from 17.2.0 to below 17.13.7 and from 18.0.0 to below 18.2.6 are susceptible to a regular expression denial of service (ReDoS). This vulnerability arises from an unanchored regular expression used in validations, where a valid ISO date followed by numerous fractional-second digits can lead the regex engine to restart its search at multiple positions in the string. Consequently, this allows a remote attacker to send crafted strings that significantly delay application response times, with potential processing times that increase with input length. Users are advised to upgrade their Joi package to the patched versions or implement string length limitations as an immediate workaround.

References