CVE-2026-90771

Low

Description

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

SeverityLow

CVSS3.7

Exploit probability—

ProductJoi

PublishedSep 13, 2026

First seenSep 13, 2026

Weakness typeCWE-1321Prototype pollution

How to fix

Update

joi17.13.8, 18.2.9 or later

Patches

github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb

Affected products

Product	Affected versions	Fixed in
joinpm	v < 17.13.8, 18.0.0 ≤ v < 18.2.9	17.13.8, 18.2.9

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.