CVE-2026-92599— Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Quick assessment
Affected
hapijs joi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： joi（npm 包 ，hapi.js）中，版本 和 存在正则表达式拒绝服务（ReDoS）漏洞，具体出现在 校验规则中。该规则应用于输入的某个正则表达式未加锚点（unanchored），因此，当一个合法的 ISO 日期后紧跟一长串小数秒数字时，正则引擎会迫使在字符串的每个位置重新开始搜索，导致耗时与输入长度的平方成正比（例如，64 KB 的数字串耗时约 1.4 秒，256 KB 耗时约 22 秒）。能够向 校验提供字符串的远程攻击者可以通过单个请求使应用程序停顿。该问题已在版本 17.1
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92599
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Source: CVE Program / CVE List V5
Vulnerability Description
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-92599
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92599
请登录查看更多情报信息。
Other References for CVE-2026-92599 (2)
-
-
🔗 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: joi
-
CVE-2026-90771
joi before 17.13.8 and 18.2.9 Prototype Pollution via messag -
CVE-2026-84368
joi: Prototype pollution via a `__proto__` language key in c -
CVE-2026-84367
joi: object().rename() with a template target can set the va -
CVE-2026-48038
joi: Uncaught RangeError on deeply nested input through recu
Same vendor: hapijs
-
CVE-2026-90771
joi before 17.13.8 and 18.2.9 Prototype Pollution via messag -
CVE-2026-84368
joi: Prototype pollution via a `__proto__` language key in c -
CVE-2026-84367
joi: object().rename() with a template target can set the va -
CVE-2026-48049
@hapi/inert: Static-file confinement bypass via sibling-pref -
CVE-2026-48022
@hapi/wreck: Sensitive credential headers leak across cross-
Same weakness: CWE-1333
-
CVE-2026-92114
a2ui-project a2ui Basic Catalog safe_regex.ts redos -
CVE-2026-57577
DotVVM: ReDOS in routing -
CVE-2026-75880
Apache Artemis, Apache ActiveMQ Artemis: Message selector wi -
CVE-2026-87819
GitPython before 3.1.60 Denial of Service via ReDoS -
CVE-2026-86081
n8n: Regular Expression Denial of Service in the Default Blo
V. Comments for CVE-2026-92599
No comments yet