Executive brief
joi is a popular data validation library used to check input data integrity in JavaScript applications. A prototype pollution vulnerability in its messages compilation function allows attackers to inject malicious __proto__ keys through custom error messages, corrupting the application's object prototype and breaking built-in Object methods. This can cause application crashes or unexpected behavior depending on how downstream code relies on Object.prototype.
Technical details
The vulnerability is a prototype pollution flaw in the messages.js compile function. The vulnerable code iterates over message object keys without filtering __proto__ or constructor, allowing an attacker to supply __proto__ as an error code in custom messages. When the code assigns nested message values into target[code], it inadvertently replaces the prototype chain of the target object. The attack requires the attacker to control the messages input passed to the compile function, such as through application configuration or API endpoints that accept custom validation messages. Successfully exploiting this breaks Object.prototype method availability for downstream code, potentially causing denial of service or logic errors. Patches are available in joi versions 17.13.8 and 18.2.9 and later.
Affected products
- hapijs joi before 17.13.8 and 18.2.9
Timeline
- 2026-09-13: disclosed