{"id":"GHSA-6w3j-5fw6-r9vr","summary":"joi: Prototype pollution via a `__proto__` language key in custom messages","details":"### Impact\nAn application that passes attacker-controlled data into joi's custom message configuration (`messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`) lets the attacker write properties onto `Object.prototype`, where every object in the process then inherits them. A key named `__proto__` was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new own property; a key named `constructor` did the same to the `Object` function's statics. A consuming application that gates on the mere presence of a property (`if (user.isAdmin)`) can be made to take the wrong branch for every object it inspects.\n\nThis is not reachable from data that joi validates. Custom messages are schema-construction configuration, normally written by the application developer. Exploitation therefore requires an application that feeds untrusted input straight into schema construction.\n\n### Patches\nUpgrade to version 18.2.5 or 17.13.6.\n\n### Workarounds\nDo not pass untrusted input into `messages()`, `message()`, `prefs({ messages })`, `Joi.extend({ messages })` or `rule({ message })`. Or validate that they don't contain any `__proto__` or `constructor` property.","aliases":["CVE-2026-84368"],"modified":"2026-09-08T21:25:53.820675Z","published":"2026-09-08T20:55:58Z","database_specific":{"cwe_ids":["CWE-1321"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-09-08T20:55:58Z","nvd_published_at":"2026-09-01T21:18:47Z"},"references":[{"type":"WEB","url":"https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84368"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3138"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3139"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa"},{"type":"PACKAGE","url":"https://github.com/hapijs/joi"}],"affected":[{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"17.2.0"},{"fixed":"17.13.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6w3j-5fw6-r9vr/GHSA-6w3j-5fw6-r9vr.json"}},{"package":{"name":"@hapi/joi","ecosystem":"npm","purl":"pkg:npm/%40hapi/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"last_affected":"17.1.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6w3j-5fw6-r9vr/GHSA-6w3j-5fw6-r9vr.json"}},{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.2.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6w3j-5fw6-r9vr/GHSA-6w3j-5fw6-r9vr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}