Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s. Patches Upgrade to version 17.13.7 or 18.2.6 depending on your current major version. Workarounds None except capping the length of the string before it reaches joi.
Recommended action: Upgrade to 18.2.6 or 17.13.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Recommended action: Upgrade to 18.2.9 or 17.13.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-proto with an object value and make the rename target render as proto, which sets the prototype of the object joi returns instead of creating a key on it. The global Object.prototype is not modified, so the effect is confined to the object returned by that one validate() call. Schemas using a static string rename target are not affected, and neither are schemas left on the default { multiple: false }. Patches Versions 17.13.5 and 18.2.4 have been released to address the issue. Workarounds 1. Replace the template rename target with a static string target. 2. Keep the template but make the capture…
Recommended action: Upgrade to 18.2.4 or 17.13.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends on how the application invokes joi: - Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process. - Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling. Patches Upgrade to version = 18.2.1. Workarounds Try/catch the validation to avoid uncaught exceptions. References - Pull request: hapijs/joi#3113
Recommended action: Upgrade to 18.2.1 or 17.13.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.