Is CVE-2026-92599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92599 being exploited in the wild.

How severe is CVE-2026-92599?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

joi (npm) SEMVER:introduced=17.2.0,fixed=17.13.7.

Is there a fix for CVE-2026-92599?

Yes. joi (npm): upgrade to 17.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92599 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92599?

Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92599: joi regular expression denial of service in isoDate validation

CVE-2026-92599 · Severity: high · CVSS 7.5 · Published 2026-09-16

joi is a popular data validation library used in Node.js applications. The library contains a vulnerability in its ISO date validation function that allows an attacker to cause the application to become unresponsive by submitting specially crafted input. A single malicious request can consume significant CPU resources and stall the entire application for seconds or longer, effectively denying service to legitimate users.

Technologies: joi (npm). Vendors: npm.

Quick answers

Is CVE-2026-92599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92599 being exploited in the wild.
How severe is CVE-2026-92599?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: joi (npm) SEMVER:introduced=17.2.0,fixed=17.13.7.
Is there a fix for CVE-2026-92599?: Yes. joi (npm): upgrade to 17.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92599 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92599?: Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

joi (npm): upgrade to 17.13.7 or later
```
npm install joi@17.13.7
```

Technical details

This vulnerability is a regular expression denial of service (ReDoS) affecting the Joi.string().isoDate() validation rule. The vulnerability stems from an unanchored regular expression used to validate ISO 8601 date strings. When an attacker supplies a valid ISO date followed by a long sequence of fractional-second digits, the regex engine exhibits quadratic backtracking behavior, restarting its search from every position in the input string. No authentication or user interaction is required; any application accepting user-supplied strings through isoDate validation is exploitable. The attack demonstrates polynomial time complexity—approximately 1.4 seconds for 64 KB of input and 22 seconds for 256 KB—enabling application stalling with a single HTTP request. Patches are available in versions 17.13.7 and 18.2.6.

Affected products

hapijs joi >=17.2.0 <17.13.7, >=18.0.0 <18.2.6

Identifiers

CVE-2026-92599
GHSA-6h2x-m376-mqjq

Timeline

2026-09-02: disclosed
2026-09-02: patched: Versions 17.13.7 and 18.2.6 released
2026-09-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.