npmPackage

@hapi/joi

3 known vulnerabilities (1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 17.1.1 (Mar 14, 2020): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 1 high, 1 medium, 1 low

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-122131Medium 6.3
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Key
Affected: from 16.0.0, through 17.1.1.
No fix released. The latest release, 17.1.1, is still affected.
38% of @hapi/joi downloads last week were affected versions (1M).
CVE-2026-118772High 7.5
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
Affected: from 16.0.0, through 17.1.1.
No fix released. The latest release, 17.1.1, is still affected.
38% of @hapi/joi downloads last week were affected versions (1M).
CVE-2026-84368Low 3.7
joi: Prototype pollution via a `proto` language key in custom messages
Affected: from 16.0.0, through 17.1.1.
No fix released. The latest release, 17.1.1, is still affected.
38% of @hapi/joi downloads last week were affected versions (1M).