CVE-2026-84368: joi: Prototype pollution via a `__proto__` language key in custom messages
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named proto writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.6 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 18.2.5 - Compensating control
Do not pass untrusted input directly into schema-construction configuration that supplies attacker-controlled language keys via messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }); the prototype-pollution path in joi is not reachable from data that joi validates.
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications are exposed only if they pass untrusted input directly into Joi schema-construction message configuration, including messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). Data being validated by Joi does not reach the vulnerable path.
What does an attacker need to provide to exploit it?
An attacker needs control over a language key in custom message configuration and must be able to supply a key named __proto__. Exploitation can pollute Object.prototype, potentially causing applications that test inherited properties to take an incorrect branch.
Are default Joi configurations affected?
The issue requires attacker-controlled custom message language keys during schema construction. The provided information does not indicate that ordinary validation input or a configuration without untrusted message definitions is affected.
What versions should be used to remediate the issue?
Upgrade joi to version 17.13.6 or 18.2.5. No fixed version is available for @hapi/joi.
What can be done if upgrading is not immediately possible?
Do not feed untrusted input into Joi custom-message or schema-construction configuration. In particular, prevent attacker-controlled language keys from reaching the listed message configuration APIs.