Executive brief
Joi is a popular data validation library used to ensure input data conforms to expected schemas. A flaw in the rename() function allows attackers to pollute the prototype of validated objects when using regex-based key renaming with template expressions and the multiple: true option. By sending a specially crafted input key like "x-__proto__", an attacker can modify the prototype chain of individual validation results, potentially allowing unauthorized property injection into returned objects.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the rename() method of Joi's object schema validation. The flaw occurs only when a schema uses .rename() with a regex source pattern, a Joi.x() template expression target that interpolates captured groups from the regex (e.g., .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })), and the { multiple: true } option is set. An attacker controlling input keys can provide "x-__proto__" as a key name; when the regex matches and the template is rendered, the key becomes "__proto__", causing the rename operation to set the prototype of the returned object instead of creating a regular property. The effect is limited to the object returned by that single validate() call and does not affect the global Object.prototype. The vulnerability requires a specific schema configuration and is not present in schemas using static string rename targets or the default { multiple: false } behavior. Patches are available in versions 17.13.5 and 18.2.4.
Affected products
- Hapi Joi >=16.0.0, <17.13.5; >=18.0.0, <18.2.4
Timeline
- 2026-08-19: disclosed: Published by GitHub Advisory Database
- 2026-09-01: advisory: Published to National Vulnerability Database
- 2026-09-08: patched: Patches released in versions 17.13.5 and 18.2.4