CVE-2026-118772: Joi email validation ReDoS in multi-address mode

CVE-2026-118772 · Severity: high · CVSS 7.5 · Published 2026-10-29

Joi is a popular JavaScript data validation library. When validating email addresses with the multiple-address option enabled, a maliciously crafted input with excessive whitespace can cause the validation to consume enormous CPU resources, blocking the application from handling other requests for seconds. An attacker can exploit this to launch a denial-of-service attack against any web application that validates untrusted email input using this specific Joi feature.

Technologies: joi (npm). Vendors: npm.

Quick answers

Is CVE-2026-118772 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118772 being exploited in the wild.
How severe is CVE-2026-118772?
High severity, with a CVSS score of 7.5, published 29 October 2026.
Which products and versions are affected?
Hapijs Joi 17.1.1 through 17.13.8, 18.0.0 through 18.3.0; @hapi/joi (npm) >= 16.0.0, <= 17.1.1, SEMVER:introduced=16.0.0,last_affected=17.1.1; joi (npm) >= 17.1.1, < 17.13.9, SEMVER:introduced=17.1.1,fixed=17.13.9.
Is there a fix for CVE-2026-118772?
Yes. joi (npm): upgrade to 17.13.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118772 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-118772?
Check whether you run Hapijs Joi, @hapi/joi (npm) or joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • joi (npm): upgrade to 17.13.9 or later
    npm install joi@17.13.9

Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) caused by catastrophic backtracking in the email separator regex when processing long runs of whitespace. The regex pattern uses a leading whitespace quantifier that retries at every position in whitespace runs, causing quadratic-time complexity during String.prototype.split. The flaw affects email validation with the multiple option enabled; applications using abortEarly: false may be vulnerable even with a .max() length rule, since the email validator runs after the length check fails.

Affected products

  • hapijs joi 17.1.1 through 17.13.8, 18.0.0 through 18.3.0

Identifiers

  • CVE-2026-118772
  • GHSA-4528-x5fx-h6hg

Timeline

  • 2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.