CVE-2026-92599
Description
A flaw was found in joi. A remote attacker can exploit an unanchored regular expression in the Joi.string().isoDate() validation rule by supplying a specially crafted string. This input, consisting of a valid ISO date followed by a long sequence of fractional-second digits, causes the regular expression engine to consume excessive processing time. This vulnerability leads to a Regular Expression Denial of Service (ReDoS), allowing the attacker to stall the application with a single request.
Statement
This is an Important denial of service vulnerability as it can be exploited remotely without authentication. An unanchored regular expression in the isoDate validation rule of the joi library allows an attacker to provide a crafted input, leading to excessive resource consumption and application unresponsiveness. This can significantly impact the availability of services utilizing the vulnerable joi versions for ISO date validation.
Mitigation
To mitigate this vulnerability, ensure that any input strings processed by the `Joi.string().isoDate()` validation rule are capped in length before being passed to the 'joi' package. This can prevent the regular expression engine from consuming excessive resources and causing a denial of service.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
