CVE-2026-84368
Description
A flaw was found in joi. This vulnerability, known as prototype pollution, allows an attacker to inject properties into core JavaScript objects by supplying untrusted input directly into schema-construction configuration. Specifically, by using language keys like __proto__ or constructor in custom messages, an attacker can write properties onto Object.prototype or the Object function's static properties. This can lead to a consuming application taking incorrect execution paths, potentially altering its behavior in unexpected ways.
Statement
A flaw was found in joi, a data validation library for JavaScript. Prototype pollution exists in the message compilation and merging logic, where attacker-controlled language keys such as proto supplied through schema configuration methods can write properties onto Object.prototype. Exploitation requires an application to pass untrusted input directly into schema-construction configuration, not into validated data, making real-world impact limited.
Mitigation
Upgrade to joi 17.13.6 or 18.2.5. As a workaround, ensure that only trusted, developer-controlled input is passed into joi schema configuration methods such as messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Do not pass user-supplied data directly into schema construction.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
