CVE-2026-92599: Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
joi (npm package joi, hapi.js) versions =17.2.0 17.13.7 and =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string().isoDate() validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
Other sources
joi (npm package joi, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the Joi.string().isoDate() validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 17.13.7 - Upgrade
Upgrade
joito a version that resolves this vulnerability.Fixed in 18.2.6 - Compensating control
Cap the length of strings before they reach joi's Joi.string().isoDate() validation rule.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the npm package joi in versions >=17.2.0 and <17.13.7, or >=18.0.0 and <18.2.6, are affected if they use the Joi.string().isoDate() validation rule on attacker-controlled input.
What does an attacker need to exploit the vulnerability?
An attacker only needs network access to an application endpoint that passes a supplied string to an isoDate validation. A valid ISO date followed by a long sequence of fractional-second digits can cause a single request to stall the application.
What can be done if upgrading is not immediately possible?
Cap the input string length before it reaches joi. This limits the quadratic regex processing triggered by long runs of fractional-second digits.
How can I assess potential impact in my application?
Identify uses of Joi.string().isoDate() and determine whether their input can be supplied remotely or by untrusted users. Inputs approaching 64 KB of crafted digits may consume about 1.4 seconds of processing, while 256 KB may consume about 22 seconds.