CVE-2026-118772: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.9
Event History
Frequently Asked Questions
Which applications are exposed to this denial-of-service condition?
Applications using affected Joi versions are exposed when they validate attacker-controlled input with string().email({ multiple: true }) and do not enforce an effective length limit before that rule runs. A single long whitespace-containing value without a separator can block the Node.js event loop for seconds.
Does using a custom separator avoid the issue?
No. The behavior applies both to Joi's default separator and to every custom separator.
Is a .max() validation rule sufficient mitigation?
Not by itself when abortEarly is false. In that configuration, Joi can still evaluate the email rule after the maximum-length check fails, so input length must be limited effectively before this validation occurs.
Which versions contain fixes?
The issue is fixed in Joi versions 17.13.9 and 18.3.1.