Executive brief
Joi is a popular data validation library for JavaScript applications. An attacker who can inject untrusted input into Joi's custom message configuration can modify the Object prototype, causing all objects in the application to inherit malicious properties. This could allow an attacker to bypass authorization checks or alter application logic that depends on property values—for example, injecting an `isAdmin` property to gain elevated privileges.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Joi's message configuration handling. When processing custom messages passed to `messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })`, or `rule({ message })`, the library fails to sanitize keys like `__proto__` and `constructor`. These special keys allow an attacker to modify Object.prototype and the Object function's static properties, respectively. Attack prerequisites are high: the application must feed untrusted input directly into schema construction (not into validated data); this is not the typical usage pattern. Successful exploitation affects applications that gate on the presence of properties (e.g., `if (user.isAdmin)`), causing logic to take unintended branches. Patches are available in joi 17.13.6 and 18.2.5, as well as @hapi/joi versions with corresponding fixes.
Affected products
- hapijs joi 17.2.0 to 17.13.5, 18.0.0 to 18.2.4
- hapijs @hapi/joi 16.0.0 to 17.1.1
Timeline
- 2026-08-19: disclosed: Vulnerability published by hapijs/joi maintainers
- 2026-08-19: patched: Patches released: joi 17.13.6, joi 18.2.5
- 2026-09-08: advisory: GHSA-6w3j-5fw6-r9vr and CVE-2026-84368 published