CVE-2026-122131: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a proto language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joito a version that resolves this vulnerability.Fixed in 17.13.9 - Upgrade
Upgrade
Joito a version that resolves this vulnerability.Fixed in 18.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected Joi versions are exposed if untrusted input can reach message configuration through any().messages(), prefs, validate options, or Joi.extend. The impact is limited to validation error rendering and logic that depends on compiled messages.
What does an attacker need to exploit it?
An attacker must be able to supply a message configuration containing a __proto__ language key through one of the affected configuration paths. No authentication or user interaction is required, but exploitation has high attack complexity.
Are default Joi deployments affected?
The issue requires untrusted message configuration to be passed into an affected API. The provided information does not indicate that ordinary validation input alone can trigger it.
What can be done before patching?
Do not accept message configuration, preferences, validation options, or Joi extensions from untrusted sources. Reject or remove __proto__ keys from any language or message configuration before passing it to Joi.
How can teams identify potentially affected usage?
Review code paths that call any().messages(), set prefs or validate options, or use Joi.extend, and determine whether their configuration can be influenced by untrusted data. Check whether the deployed Joi version is earlier than 17.13.9 in the 17.13.x line or earlier than 18.3.1 in the 18.2.x line.