# CVE-2026-84367: Hapi Joi object().rename() prototype pollution via template target

Source: https://junglewise.ai/threats/cve-2026-84367-hapi-joi-object-rename-prototype-pollution-via-template-target  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84367 · Severity: low · CVSS 3.7 · Published 2026-09-01

Joi is a popular data validation library used to ensure input data conforms to expected schemas. A flaw in the rename() function allows attackers to pollute the prototype of validated objects when using regex-based key renaming with template expressions and the multiple: true option. By sending a specially crafted input key like "x-__proto__", an attacker can modify the prototype chain of individual validation results, potentially allowing unauthorized property injection into returned objects.

Technologies: [joi (npm)](https://junglewise.ai/threats/technologies/joi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84367 being exploited in the wild.

**How severe is CVE-2026-84367?** Low severity, with a CVSS score of 3.7, published 1 September 2026.

**Which products and versions are affected?** joi (npm) SEMVER:introduced=16.0.0,fixed=17.13.5.

**Is there a fix for CVE-2026-84367?** Yes. joi (npm): upgrade to 17.13.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84367 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84367?** Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joi (npm): upgrade to 17.13.5 or later

  ```sh
  npm install joi@17.13.5
  ```


## Technical details

This is a prototype pollution vulnerability (CWE-1321) in the rename() method of Joi's object schema validation. The flaw occurs only when a schema uses .rename() with a regex source pattern, a Joi.x() template expression target that interpolates captured groups from the regex (e.g., .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })), and the { multiple: true } option is set. An attacker controlling input keys can provide "x-__proto__" as a key name; when the regex matches and the template is rendered, the key becomes "__proto__", causing the rename operation to set the prototype of the returned object instead of creating a regular property. The effect is limited to the object returned by that single validate() call and does not affect the global Object.prototype. The vulnerability requires a specific schema configuration and is not present in schemas using static string rename targets or the default { multiple: false } behavior. Patches are available in versions 17.13.5 and 18.2.4.

## Affected products

- Hapi Joi >=16.0.0, <17.13.5; >=18.0.0, <18.2.4

## Identifiers

- CVE-2026-84367
- GHSA-gg4h-3hg2-grpc

## Timeline

- 2026-08-19: disclosed: Published by GitHub Advisory Database
- 2026-09-01: advisory: Published to National Vulnerability Database
- 2026-09-08: patched: Patches released in versions 17.13.5 and 18.2.4

## References

- [https://api.github.com/users/Zyy0530](https://api.github.com/users/Zyy0530)
- [https://github.com/Zyy0530](https://github.com/Zyy0530)
- [https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D](https://api.github.com/users/Zyy0530/gists%7B/gist_id%7D)
- [https://api.github.com/users/Zyy0530/repos](https://api.github.com/users/Zyy0530/repos)
- [https://avatars.githubusercontent.com/u/202744044?v=4](https://avatars.githubusercontent.com/u/202744044?v=4)
- [https://api.github.com/users/Zyy0530/events%7B/privacy%7D](https://api.github.com/users/Zyy0530/events%7B/privacy%7D)

## Related threats

- [Joi email validation ReDoS in multi-address mode](https://junglewise.ai/threats/cve-2026-118772-joi-is-a-schema-description-language-and-data-validator-for)
- [joi regular expression denial of service in isoDate validation](https://junglewise.ai/threats/duplicate-advisory-joi-quadratic-regular-expression-backtracking-in-joi-0593de22)
- [joi regular expression denial of service in isoDate validation](https://junglewise.ai/threats/cve-2026-92599-joi-regular-expression-denial-of-service-in-isodate-validation)
- [joi prototype pollution in messages compilation](https://junglewise.ai/threats/cve-2026-90771-joi-prototype-pollution-in-messages-compilation)
- [Joi prototype pollution via __proto__ in custom messages](https://junglewise.ai/threats/cve-2026-84368-joi-prototype-pollution-via-proto-in-custom-messages)