joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and
    18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading
    whitespace quantifier is retried at every position in a long whitespace run that contains no separator,
    causing quadratic work during String.prototype.split. The behavior applies to the default separator and
    every custom separator. Applications that validate attacker-controlled values with the multiple option and
    no effective prior length limit can have the Node.js event loop blocked for seconds by one request,
    preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run
    after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
    (CVE-2026-118772)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and     18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading     whitespace quantifier is retried at every position in a long whitespace run that contains no separator,     causing quadratic work during String.prototype.split. The behavior applies to the default separator and     every custom separator. Applications that validate attacker-controlled values with the multiple option and     no effective prior length limit can have the Node.js event loop blocked for seconds by one request,     preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run     after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
    (CVE-2026-118772)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
478084	SCA: security update for @hapi/joi, joi (GHSA-4528-x5fx-h6hg)	Tenable Cloud Security	SCA Checks	Local	high
478084	SCA: security update for @hapi/joi, joi (GHSA-4528-x5fx-h6hg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
374107	Linux Distros Unpatched Vulnerability : CVE-2026-118772	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-118772

high

Tenable Plugins

high

high

high