All 7 CVE vulnerabilities found in joi, with AI-generated Chinese analysis, references, and POCs.
Vendor: hapijs
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-122131 | Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key CWE-1321 | 3.7 | Low | 2026-11-04 |
| CVE-2026-118772 | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service CWE-1333 | 7.5 | High | 2026-10-29 |
| CVE-2026-92599 | Joi before 17.13.7 and 18.2.6 ReDoS via isoDate CWE-1333 | 7.5 | High | 2026-09-16 |
| CVE-2026-90771 | joi before 17.13.8 and 18.2.9 Prototype Pollution via messages CWE-1321 | 3.7 | Low | 2026-09-13 |
| CVE-2026-84368 | joi: Prototype pollution via a `__proto__` language key in custom messages CWE-1321 | 3.7 | Low | 2026-09-01 |
| CVE-2026-84367 | joi: object().rename() with a template target can set the validated object's prototype CWE-1321 | 3.7 | Low | 2026-09-01 |
| CVE-2026-48038 | joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas CWE-248 | 5.3 | Medium | 2026-07-14 |
All 7 known CVE vulnerabilities affecting joi with full Chinese analysis, references, and POCs where available.