hapijs joi up to 17.13.4/18.2.3 Rename lib/types/keys.js internals.rename key prototype pollution

Summaryinfo

A vulnerability described as critical has been identified in hapijs joi up to 17.13.4/18.2.3. This affects the function internals.rename of the file lib/types/keys.js of the component Rename. Such manipulation of the argument key leads to prototype pollution. This vulnerability is referenced as CVE-2026-84367. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in hapijs joi up to 17.13.4/18.2.3 and classified as critical. Affected by this issue is the function internals.rename of the file lib/types/keys.js of the component Rename. The manipulation of the argument key with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Impacted is confidentiality, integrity, and availability. CVE summarizes:

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-84367 since 09/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 17.13.5 or 18.2.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• hapijs

Name

• joi

Version

• 17.13.0
• 17.13.1
• 17.13.2
• 17.13.3
• 17.13.4
• 18.2.0
• 18.2.1
• 18.2.2
• 18.2.3

Website

• Product: https://github.com/hapijs/joi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion