CVE-2026-90771: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.8 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 18.2.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using joi versions earlier than 17.13.8 or earlier than 18.2.9 are affected when they compile custom messages that can contain an attacker-supplied __proto__ error-code key.
What must an attacker be able to do to exploit this?
An attacker must be able to supply custom messages containing a __proto__ key. The vulnerable messages compilation function can then replace the returned object's prototype.
What is the practical impact?
The issue can break downstream code that relies on Object.prototype methods on the returned object. The reported impact is integrity-related; no confidentiality or availability impact is specified.
What should be done if an affected version is in use?
Upgrade to joi 17.13.8 or 18.2.9, as applicable. Until upgrading, prevent untrusted input from being used as custom message keys, particularly the __proto__ key.