Bug 2527368 (CVE-2026-84368) - CVE-2026-84368 joi: @hapi/joi: joi: Prototype pollution via untrusted input in schema configuration
Summary: CVE-2026-84368 joi: @hapi/joi: joi: Prototype pollution via untrusted input i...
Keywords:
Status: NEW
Alias: CVE-2026-84368
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2527887 2527891 2527892 2527888 2527889 2527890 2527893
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-02 12:50 UTC by OSIDB Bzimport
Modified: 2026-09-03 08:48 UTC (History)
44 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-02 12:50:36 UTC
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.


Note You need to log in before you can comment on or make changes to this bug.