Is CVE-2026-84367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84367 being exploited in the wild.

How severe is CVE-2026-84367?

Low severity, with a CVSS score of 3.7, published 1 September 2026.

Which products and versions are affected?

joi (npm) SEMVER:introduced=16.0.0,fixed=17.13.5.

Is there a fix for CVE-2026-84367?

Yes. joi (npm): upgrade to 17.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84367 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84367?

Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84367: Hapi Joi object().rename() prototype pollution via template target

CVE-2026-84367 · Severity: low · CVSS 3.7 · Published 2026-09-01

Joi is a popular data validation library used to ensure input data conforms to expected schemas. A flaw in the rename() function allows attackers to pollute the prototype of validated objects when using regex-based key renaming with template expressions and the multiple: true option. By sending a specially crafted input key like "x-__proto__", an attacker can modify the prototype chain of individual validation results, potentially allowing unauthorized property injection into returned objects.

Technologies: joi (npm). Vendors: npm.

Quick answers

Is CVE-2026-84367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84367 being exploited in the wild.
How severe is CVE-2026-84367?: Low severity, with a CVSS score of 3.7, published 1 September 2026.
Which products and versions are affected?: joi (npm) SEMVER:introduced=16.0.0,fixed=17.13.5.
Is there a fix for CVE-2026-84367?: Yes. joi (npm): upgrade to 17.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84367 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84367?: Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

joi (npm): upgrade to 17.13.5 or later
```
npm install joi@17.13.5
```

Technical details

This is a prototype pollution vulnerability (CWE-1321) in the rename() method of Joi's object schema validation. The flaw occurs only when a schema uses .rename() with a regex source pattern, a Joi.x() template expression target that interpolates captured groups from the regex (e.g., .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })), and the { multiple: true } option is set. An attacker controlling input keys can provide "x-__proto__" as a key name; when the regex matches and the template is rendered, the key becomes "__proto__", causing the rename operation to set the prototype of the returned object instead of creating a regular property. The effect is limited to the object returned by that single validate() call and does not affect the global Object.prototype. The vulnerability requires a specific schema configuration and is not present in schemas using static string rename targets or the default { multiple: false } behavior. Patches are available in versions 17.13.5 and 18.2.4.

Affected products

Hapi Joi >=16.0.0, <17.13.5; >=18.0.0, <18.2.4

Identifiers

CVE-2026-84367
GHSA-gg4h-3hg2-grpc

Timeline

2026-08-19: disclosed: Published by GitHub Advisory Database
2026-09-01: advisory: Published to National Vulnerability Database
2026-09-08: patched: Patches released in versions 17.13.5 and 18.2.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.