# CVE-2026-92599: joi regular expression denial of service in isoDate validation

Source: https://junglewise.ai/threats/cve-2026-92599-joi-regular-expression-denial-of-service-in-isodate-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92599 · Severity: high · CVSS 7.5 · Published 2026-09-16

joi is a popular data validation library used in Node.js applications. The library contains a vulnerability in its ISO date validation function that allows an attacker to cause the application to become unresponsive by submitting specially crafted input. A single malicious request can consume significant CPU resources and stall the entire application for seconds or longer, effectively denying service to legitimate users.

Technologies: [joi (npm)](https://junglewise.ai/threats/technologies/joi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-92599 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92599 being exploited in the wild.

**How severe is CVE-2026-92599?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** joi (npm) SEMVER:introduced=17.2.0,fixed=17.13.7.

**Is there a fix for CVE-2026-92599?** Yes. joi (npm): upgrade to 17.13.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92599 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92599?** Check whether you run joi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joi (npm): upgrade to 17.13.7 or later

  ```sh
  npm install joi@17.13.7
  ```


## Technical details

This vulnerability is a regular expression denial of service (ReDoS) affecting the Joi.string().isoDate() validation rule. The vulnerability stems from an unanchored regular expression used to validate ISO 8601 date strings. When an attacker supplies a valid ISO date followed by a long sequence of fractional-second digits, the regex engine exhibits quadratic backtracking behavior, restarting its search from every position in the input string. No authentication or user interaction is required; any application accepting user-supplied strings through isoDate validation is exploitable. The attack demonstrates polynomial time complexity—approximately 1.4 seconds for 64 KB of input and 22 seconds for 256 KB—enabling application stalling with a single HTTP request. Patches are available in versions 17.13.7 and 18.2.6.

## Affected products

- hapijs joi >=17.2.0 <17.13.7, >=18.0.0 <18.2.6

## Identifiers

- CVE-2026-92599
- GHSA-6h2x-m376-mqjq

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Versions 17.13.7 and 18.2.6 released
- 2026-09-16: advisory

## References

- [https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq](https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq)
- [https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate](https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate)

## Related threats

- [Joi email validation ReDoS in multi-address mode](https://junglewise.ai/threats/cve-2026-118772-joi-is-a-schema-description-language-and-data-validator-for)
- [joi regular expression denial of service in isoDate validation](https://junglewise.ai/threats/duplicate-advisory-joi-quadratic-regular-expression-backtracking-in-joi-0593de22)
- [joi prototype pollution in messages compilation](https://junglewise.ai/threats/cve-2026-90771-joi-prototype-pollution-in-messages-compilation)
- [Joi prototype pollution via __proto__ in custom messages](https://junglewise.ai/threats/cve-2026-84368-joi-prototype-pollution-via-proto-in-custom-messages)
- [Hapi Joi object().rename() prototype pollution via template target](https://junglewise.ai/threats/cve-2026-84367-hapi-joi-object-rename-prototype-pollution-via-template-target)