Executive brief
joi is a popular data validation library used in Node.js applications. The library contains a vulnerability in its ISO date validation function that allows an attacker to cause the application to become unresponsive by submitting specially crafted input. A single malicious request can consume significant CPU resources and stall the entire application for seconds or longer, effectively denying service to legitimate users.
Technical details
This vulnerability is a regular expression denial of service (ReDoS) affecting the Joi.string().isoDate() validation rule. The vulnerability stems from an unanchored regular expression used to validate ISO 8601 date strings. When an attacker supplies a valid ISO date followed by a long sequence of fractional-second digits, the regex engine exhibits quadratic backtracking behavior, restarting its search from every position in the input string. No authentication or user interaction is required; any application accepting user-supplied strings through isoDate validation is exploitable. The attack demonstrates polynomial time complexity—approximately 1.4 seconds for 64 KB of input and 22 seconds for 256 KB—enabling application stalling with a single HTTP request. Patches are available in versions 17.13.7 and 18.2.6.
Affected products
- hapijs joi >=17.2.0 <17.13.7, >=18.0.0 <18.2.6
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Versions 17.13.7 and 18.2.6 released
- 2026-09-16: advisory