# CVE-2026-90771: joi prototype pollution in messages compilation

Source: https://junglewise.ai/threats/cve-2026-90771-joi-prototype-pollution-in-messages-compilation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90771 · Severity: low · CVSS 3.7 · Published 2026-09-13

joi is a popular data validation library used to check input data integrity in JavaScript applications. A prototype pollution vulnerability in its messages compilation function allows attackers to inject malicious __proto__ keys through custom error messages, corrupting the application's object prototype and breaking built-in Object methods. This can cause application crashes or unexpected behavior depending on how downstream code relies on Object.prototype.

Technologies: [joi (npm)](https://junglewise.ai/threats/technologies/joi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-90771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90771 being exploited in the wild.

**How severe is CVE-2026-90771?** Low severity, with a CVSS score of 3.7, published 13 September 2026.

**Which products and versions are affected?** joi (npm) SEMVER:introduced=0,fixed=17.13.8.

**Is there a fix for CVE-2026-90771?** Yes. joi (npm): upgrade to 17.13.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-90771 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90771?** Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joi (npm): upgrade to 17.13.8 or later

  ```sh
  npm install joi@17.13.8
  ```


## Technical details

The vulnerability is a prototype pollution flaw in the messages.js compile function. The vulnerable code iterates over message object keys without filtering __proto__ or constructor, allowing an attacker to supply __proto__ as an error code in custom messages. When the code assigns nested message values into target[code], it inadvertently replaces the prototype chain of the target object. The attack requires the attacker to control the messages input passed to the compile function, such as through application configuration or API endpoints that accept custom validation messages. Successfully exploiting this breaks Object.prototype method availability for downstream code, potentially causing denial of service or logic errors. Patches are available in joi versions 17.13.8 and 18.2.9 and later.

## Affected products

- hapijs joi before 17.13.8 and 18.2.9

## Identifiers

- CVE-2026-90771
- GHSA-wr44-6hxh-3jwq

## Timeline

- 2026-09-13: disclosed

## References

- [https://github.com/hapijs/joi](https://github.com/hapijs/joi)
- [https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js](https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js)

## Related threats

- [Joi email validation ReDoS in multi-address mode](https://junglewise.ai/threats/cve-2026-118772-joi-is-a-schema-description-language-and-data-validator-for)
- [joi regular expression denial of service in isoDate validation](https://junglewise.ai/threats/duplicate-advisory-joi-quadratic-regular-expression-backtracking-in-joi-0593de22)
- [joi regular expression denial of service in isoDate validation](https://junglewise.ai/threats/cve-2026-92599-joi-regular-expression-denial-of-service-in-isodate-validation)
- [Joi prototype pollution via __proto__ in custom messages](https://junglewise.ai/threats/cve-2026-84368-joi-prototype-pollution-via-proto-in-custom-messages)
- [Hapi Joi object().rename() prototype pollution via template target](https://junglewise.ai/threats/cve-2026-84367-hapi-joi-object-rename-prototype-pollution-via-template-target)