CVE-2026-92599 in joi
Summary
by MITRE • 09/17/2026
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Joi library, widely used within the hapi.js ecosystem for schema validation, contains a critical regular expression denial of service vulnerability in versions ranging from 17.2.0 up to but not including 17.13.7, and from 18.0.0 up to but not including 18.2.6. This flaw specifically affects the isoDate validation rule when processing input strings that adhere to ISO date formats followed by an excessive number of fractional-second digits. The root cause lies in the implementation of one of the regular expressions used for this validation, which is unanchored at its end boundary. Because the pattern does not strictly terminate after matching a valid date structure, the regex engine exhibits catastrophic backtracking behavior when presented with maliciously crafted input containing long sequences of digit characters following the standard date format.
From a technical perspective, an unanchored regular expression allows the matcher to attempt matches starting at every possible position within the input string if the initial match fails or requires further verification. In this specific scenario, while the prefix constitutes a valid ISO date, the subsequent stream of fractional-second digits creates ambiguity for the regex engine regarding where the valid portion ends and invalid data begins. Consequently, the engine restarts its search from each character position in the long tail of digits, resulting in computational complexity that scales quadratically with the input length. Empirical testing demonstrates significant performance degradation, with processing times reaching approximately 1.4 seconds for inputs containing sixty-four kilobytes of digit characters and escalating to roughly twenty-two seconds for two hundred fifty-six kilobytes of such data.
The operational impact of this vulnerability is severe, as it enables a remote attacker to cause a denial of service condition against the application hosting the Joi library. By submitting a single request with a sufficiently long string containing valid ISO date formatting followed by thousands or millions of fractional-second digits, an adversary can consume excessive CPU resources and block thread execution for extended periods. This effectively stalls the application's ability to process legitimate requests, leading to service unavailability without requiring authentication or complex exploitation techniques beyond supplying specific input data. The attack vector is straightforward, relying solely on the volume and structure of the payload rather than any bypass of access controls.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-400, which describes Uncontrolled Resource Consumption, specifically manifesting as a Regular Expression Denial of Service (ReDoS). In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1496, Resource Hijacking, where an attacker consumes resources to degrade the performance or availability of targeted systems. The quadratic time complexity inherent in the flawed regex logic is a classic indicator of ReDoS vulnerabilities that arise from improper anchoring and excessive backtracking potential within pattern matching routines.
To mitigate this risk, organizations should immediately upgrade their Joi dependencies to version 17.13.7 or later for the v17 branch, or version 18.2.6 or later for the v18 branch, as these releases contain patches that address the regex anchoring issue and prevent catastrophic backtracking. For environments where an immediate upgrade is not feasible due to dependency constraints, a recommended workaround involves implementing input length restrictions at the application layer before data reaches the Joi validation logic. By capping the maximum allowed string length for date fields, administrators can effectively limit the size of the fractional-second digit sequence, thereby preventing the regex engine from entering the problematic quadratic execution state and maintaining service availability against such attacks.