GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-84368

Vulnerability from fkie_nvd - Published: 2026-09-01 21:18 - Updated: 2026-09-02 13:18
Severity
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
References
security-advisories@github.comhttps://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
security-advisories@github.comhttps://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
security-advisories@github.comhttps://github.com/hapijs/joi/pull/3138
security-advisories@github.comhttps://github.com/hapijs/joi/pull/3139
security-advisories@github.comhttps://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "joi",
          "vendor": "hapijs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c= 17.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.2.0, \u003c 17.13.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.0.0, \u003c 18.2.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function\u0027s static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available."
    }
  ],
  "id": "CVE-2026-84368",
  "lastModified": "2026-09-02T13:18:14.540",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84368",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T12:11:08.547444Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T21:18:47.887",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapijs/joi/pull/3138"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapijs/joi/pull/3139"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.