CVE-2026-90771: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

Q: Which deployments are exposed?

Deployments using joi versions earlier than 17.13.8 or earlier than 18.2.9 are affected when they compile custom messages that can contain an attacker-supplied __proto__ error-code key.

Q: What must an attacker be able to do to exploit this?

An attacker must be able to supply custom messages containing a __proto__ key. The vulnerable messages compilation function can then replace the returned object's prototype.

Q: What is the practical impact?

The issue can break downstream code that relies on Object.prototype methods on the returned object. The reported impact is integrity-related; no confidentiality or availability impact is specified.

Q: What should be done if an affected version is in use?

Upgrade to joi 17.13.8 or 18.2.9, as applicable. Until upgrading, prevent untrusted input from being used as custom message keys, particularly the __proto__ key.

Published Sep 13, 2026

Updated

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Affected Software

2 affected components

joi joi<17.13.8

joi joi<18.2.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade joi to a version that resolves this vulnerability.
Fixed in 17.13.8
Upgrade
Upgrade joi to a version that resolves this vulnerability.
Fixed in 18.2.9

Event History

Sep 13, 2026

CVE Published

via MITRE·10:45 AM

Data Sourced

via MITRE·10:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using joi versions earlier than 17.13.8 or earlier than 18.2.9 are affected when they compile custom messages that can contain an attacker-supplied __proto__ error-code key.

What must an attacker be able to do to exploit this?

An attacker must be able to supply custom messages containing a __proto__ key. The vulnerable messages compilation function can then replace the returned object's prototype.

What is the practical impact?

The issue can break downstream code that relies on Object.prototype methods on the returned object. The reported impact is integrity-related; no confidentiality or availability impact is specified.

What should be done if an affected version is in use?

Upgrade to joi 17.13.8 or 18.2.9, as applicable. Until upgrading, prevent untrusted input from being used as custom message keys, particularly the __proto__ key.

CVE-2026-90771: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this?

What is the practical impact?

What should be done if an affected version is in use?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What must an attacker be able to do to exploit this?

What is the practical impact?

What should be done if an affected version is in use?