hapijs joi up to 17.1.1/17.13.5/18.2.4 Message lib/messages.js exports.compile/exports.merge messages prototype pollution

Summaryinfo

A vulnerability marked as critical has been reported in hapijs joi up to 17.1.1/17.13.5/18.2.4. This issue affects the function exports.compile/exports.merge of the file lib/messages.js of the component Message Handler. Performing a manipulation of the argument messages results in prototype pollution. This vulnerability was named CVE-2026-84368. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in hapijs joi up to 17.1.1/17.13.5/18.2.4. This affects the function exports.compile/exports.merge of the file lib/messages.js of the component Message Handler. The manipulation of the argument messages with an unknown input leads to a prototype pollution vulnerability. CWE is classifying the issue as CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-84368 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 17.13.6 or 18.2.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• hapijs

Name

• joi

Version

• 17.1.0
• 17.1.1
• 17.13.0
• 17.13.1
• 17.13.2
• 17.13.3
• 17.13.4
• 17.13.5
• 18.2.0
• 18.2.1
• 18.2.2
• 18.2.3
• 18.2.4

Website

• Product: https://github.com/hapijs/joi/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion