CVE-2026-48038: joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi: - Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process. - Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.
Patches Upgrade to version >= 18.2.1.
Workarounds Try/catch the validation to avoid uncaught exceptions.
References - Pull request: hapijs/joi#3113
Other sources
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/joito a version that resolves this vulnerability.Fixed in 17.13.4 - Upgrade
Upgrade
npm/joito a version that resolves this vulnerability.Fixed in 18.2.1 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.4 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 18.2.1 - Configuration
Wrap joi validate() calls in a request handler with try/catch to prevent an untrapped RangeError (prior to 17.13.4 and 18.2.1) from potentially crashing the process.
joi usage in request handlers validate() error handling (try/catch) = Use try/catch around validate()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48038?
The severity of CVE-2026-48038 is medium with a CVSS score of 5.3.
What type of attack does CVE-2026-48038 expose the system to?
CVE-2026-48038 exposes the system to denial of service attacks due to untrapped exceptions in user-supplied JSON validation.
How do I fix CVE-2026-48038?
To fix CVE-2026-48038, ensure that all calls to the validate() function are wrapped in a try/catch block.
What software is affected by CVE-2026-48038?
CVE-2026-48038 affects the npm package joi.
What could happen if CVE-2026-48038 is exploited?
If exploited, CVE-2026-48038 could cause the application to enter a denial of service state, disrupting service availability.