CVE-2026-122131

Low

Description

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

SeverityLow

CVSS3.7

Exploit probability—

ProductHapijs Joi

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-1321Prototype pollution

How to fix

Update

hapijs joi17.13.9, 18.3.1 or later

Patches

Vendor advisories

github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr

Affected products

Product	Affected versions	Fixed in
hapijs joi	17.13.6 ≤ v < 17.13.9, 18.2.5 ≤ v < 18.3.1	17.13.9, 18.3.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.