CVE-2026-84368: Joi prototype pollution via __proto__ in custom messages

CVE-2026-84368 · Severity: low · CVSS 3.7 · Published 2026-09-01

Joi is a popular data validation library for JavaScript applications. An attacker who can inject untrusted input into Joi's custom message configuration can modify the Object prototype, causing all objects in the application to inherit malicious properties. This could allow an attacker to bypass authorization checks or alter application logic that depends on property values—for example, injecting an `isAdmin` property to gain elevated privileges.

Technologies: joi (npm). Vendors: npm.

Quick answers

Is CVE-2026-84368 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84368 being exploited in the wild.
How severe is CVE-2026-84368?
Low severity, with a CVSS score of 3.7, published 1 September 2026.
Which products and versions are affected?
@hapi/joi (npm) SEMVER:introduced=16.0.0,last_affected=17.1.1; joi (npm) SEMVER:introduced=17.2.0,fixed=17.13.6.
Is there a fix for CVE-2026-84368?
Yes. joi (npm): upgrade to 17.13.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84368 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84368?
Check whether you run @hapi/joi (npm) or joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • joi (npm): upgrade to 17.13.6 or later
    npm install joi@17.13.6

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Joi's message configuration handling. When processing custom messages passed to `messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })`, or `rule({ message })`, the library fails to sanitize keys like `__proto__` and `constructor`. These special keys allow an attacker to modify Object.prototype and the Object function's static properties, respectively. Attack prerequisites are high: the application must feed untrusted input directly into schema construction (not into validated data); this is not the typical usage pattern. Successful exploitation affects applications that gate on the presence of properties (e.g., `if (user.isAdmin)`), causing logic to take unintended branches. Patches are available in joi 17.13.6 and 18.2.5, as well as @hapi/joi versions with corresponding fixes.

Affected products

  • hapijs joi 17.2.0 to 17.13.5, 18.0.0 to 18.2.4
  • hapijs @hapi/joi 16.0.0 to 17.1.1

Identifiers

  • CVE-2026-84368
  • GHSA-6w3j-5fw6-r9vr

Timeline

  • 2026-08-19: disclosed: Vulnerability published by hapijs/joi maintainers
  • 2026-08-19: patched: Patches released: joi 17.13.6, joi 18.2.5
  • 2026-09-08: advisory: GHSA-6w3j-5fw6-r9vr and CVE-2026-84368 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.