CVE-2026-118772 in joi
Summary
by MITRE • 10/29/2026
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The Joi library, a widely used schema description language and data validator for JavaScript applications, contains a significant performance vulnerability affecting email validation logic when the multiple option is enabled. This issue specifically impacts version ranges from 17.1.1 through 17.13.9 and versions up to 18.3.1. The core of the flaw lies in the regular expression used for parsing comma-separated lists of emails, which allows a single input string containing long sequences of whitespace without valid email separators to trigger catastrophic backtracking or quadratic time complexity during processing.
The technical root cause is identified as an inefficient separator regular expression within the Joi.string().email() method when configured with multiple: true. The regex pattern includes a quantifier for leading whitespace that causes the engine to retry matching at every position within a long run of whitespace characters that do not contain any actual separators. This behavior results in quadratic work complexity, meaning the processing time increases exponentially relative to the length of the input string rather than linearly. Consequently, when an attacker provides a maliciously crafted string with extensive whitespace, the Node.js event loop becomes blocked for several seconds as it attempts to resolve this pattern match, effectively halting all other asynchronous operations within that process instance.
From an operational perspective, this vulnerability constitutes a Denial of Service condition by exhausting computational resources through algorithmic complexity rather than memory exhaustion or resource leak. The impact is particularly severe because the default separator behavior and any custom separators are susceptible to this flaw. Security practitioners must note that standard mitigation strategies such as applying a .max() rule on string length may be insufficient if the Joi configuration includes abortEarly: false. In such configurations, the validation engine continues processing rules even after initial constraints like maximum length have failed, allowing the vulnerable email parsing logic to execute and trigger the performance degradation despite prior checks failing.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as a Denial of Service via algorithmic complexity attacks. It also relates to CWE-1321, Improperly Controlled Modification of Object Prototype Attributes, in broader contexts where input validation is bypassed or misconfigured, though the primary classification here remains resource exhaustion due to inefficient regular expression handling. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1496 Resource Hijacking, specifically under sub-techniques involving CPU consumption through algorithmic complexity attacks that degrade service availability for legitimate users by monopolizing the single-threaded event loop in Node.js environments.
To mitigate this risk, organizations using affected versions of Joi must upgrade immediately to version 17.13.9 or later, which includes patches addressing the regular expression inefficiency. For applications unable to update instantly, implementing strict input length limits combined with abortEarly: true can prevent the vulnerable code path from executing after a maximum length violation is detected. Additionally, developers should review all instances of Joi.string().email() configurations that utilize the multiple option and ensure they are not processing untrusted user inputs without robust pre-validation checks to limit string size before it reaches the email parsing logic.