Executive brief
Joi is a popular data validation library for JavaScript used to ensure that information sent to a web service follows a specific format. A vulnerability in how it handles complex, recursive data structures allows an attacker to send specially crafted, deeply nested input that can crash the application. This results in a denial of service, making the affected website or service unavailable to legitimate users.
Technical details
A denial of service vulnerability exists in Joi due to an uncaught RangeError when processing deeply nested input against recursive link() schemas. The root cause is a failure to protect link recursion from exceeding the maximum call stack size. An unauthenticated remote attacker can exploit this by submitting a crafted JSON payload or object. If the application calls the synchronous validate() method without a try/catch block, the resulting unhandled exception can crash the Node.js process. In cases where validateAsync() or try/catch is used, the library returns a RangeError instead of a standard ValidationError, which may still disrupt expected error-handling logic. The issue is fixed in versions 17.13.4 and 18.2.1.
Affected products
- hapijs joi < 17.13.4, >= 18.0.0 < 18.2.1
Timeline
- 2026-05-04: patched: Fix merged into master branch
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: CVE published to NVD