CVE-2026-122131

medium

Description

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

References

https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key

https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr

https://github.com/hapijs/joi/pull/3164

https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec

https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6

https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67

https://github.com/hapijs/joi

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117085

Details

Source: Mitre, NVD

Published: 2026-11-04

Updated: 2026-11-12

Risk Information

CVSS v2

Base Score: 2.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N

Severity: Low

CVSS v3

Base Score: 3.7

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Severity: Low

CVSS v4

Base Score: 6.3

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0033